diff --git a/lib/Controller/ConfigController.php b/lib/Controller/ConfigController.php
index 397041fc..b4d085c9 100644
--- a/lib/Controller/ConfigController.php
+++ b/lib/Controller/ConfigController.php
@@ -10,9 +10,11 @@
 use OCA\Approval\Service\RuleService;
 use OCA\Approval\Service\UtilsService;
 
+use OCA\Approval\Settings\Admin;
 use OCP\App\IAppManager;
 
 use OCP\AppFramework\Controller;
+use OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\IRequest;
 
@@ -51,6 +53,7 @@ public function createTag(string $name): DataResponse {
 	 *
 	 * @return DataResponse
 	 */
+	#[AuthorizedAdminSetting(settings: Admin::class)]
 	public function getRules(): DataResponse {
 		$circlesEnabled = $this->appManager->isEnabledForUser('circles') && class_exists(\OCA\Circles\CirclesManager::class);
 		if ($circlesEnabled) {
@@ -112,6 +115,7 @@ public function getRules(): DataResponse {
 	 * @param string $description
 	 * @return DataResponse
 	 */
+	#[AuthorizedAdminSetting(settings: Admin::class)]
 	public function createRule(int $tagPending, int $tagApproved, int $tagRejected,
 		array $approvers, array $requesters, string $description): DataResponse {
 		$result = $this->ruleService->createRule($tagPending, $tagApproved, $tagRejected, $approvers, $requesters, $description);
@@ -130,6 +134,7 @@ public function createRule(int $tagPending, int $tagApproved, int $tagRejected,
 	 * @param string $description
 	 * @return DataResponse
 	 */
+	#[AuthorizedAdminSetting(settings: Admin::class)]
 	public function saveRule(int $id, int $tagPending, int $tagApproved, int $tagRejected,
 		array $approvers, array $requesters, string $description): DataResponse {
 		$result = $this->ruleService->saveRule($id, $tagPending, $tagApproved, $tagRejected, $approvers, $requesters, $description);
@@ -142,6 +147,7 @@ public function saveRule(int $id, int $tagPending, int $tagApproved, int $tagRej
 	 * @param int $id
 	 * @return DataResponse
 	 */
+	#[AuthorizedAdminSetting(settings: Admin::class)]
 	public function deleteRule(int $id): DataResponse {
 		$result = $this->ruleService->deleteRule($id);
 		return isset($result['error'])
diff --git a/lib/Settings/Admin.php b/lib/Settings/Admin.php
index 611b0d0d..58e6a721 100644
--- a/lib/Settings/Admin.php
+++ b/lib/Settings/Admin.php
@@ -10,12 +10,17 @@
 use OCA\Approval\AppInfo\Application;
 use OCP\AppFramework\Http\TemplateResponse;
 
-use OCP\Settings\ISettings;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\IGroupManager;
+use OCP\Settings\IDelegatedSettings;
 
-class Admin implements ISettings {
+class Admin implements IDelegatedSettings {
 
 	public function __construct(
 		private string $appName,
+		private IGroupManager $groupManager,
+		private IInitialState $initialStateService,
+		private ?string $userId,
 	) {
 	}
 
@@ -23,6 +28,7 @@ public function __construct(
 	 * @return TemplateResponse
 	 */
 	public function getForm(): TemplateResponse {
+		$this->initialStateService->provideInitialState('is-admin', $this->groupManager->isAdmin($this->userId));
 		return new TemplateResponse(Application::APP_ID, 'adminSettings');
 	}
 
@@ -33,4 +39,12 @@ public function getSection(): string {
 	public function getPriority(): int {
 		return 1;
 	}
+
+	public function getName(): ?string {
+		return null;
+	}
+
+	public function getAuthorizedAppConfig(): array {
+		return [];
+	}
 }
diff --git a/src/components/AdminSettings.vue b/src/components/AdminSettings.vue
index 1dabf84a..e7c71c1f 100644
--- a/src/components/AdminSettings.vue
+++ b/src/components/AdminSettings.vue
@@ -90,7 +90,7 @@
 				</template>
 				{{ t('approval', 'New workflow') }}
 			</NcButton>
-			<div class="create-tag">
+			<div v-if="isAdmin" class="create-tag">
 				<label for="create-tag-input">
 					<TagIcon :size="16" />
 					{{ t('approval', 'Create new hidden tag') }}
@@ -128,6 +128,7 @@ import ApprovalRule from './ApprovalRule.vue'
 import { generateUrl } from '@nextcloud/router'
 import axios from '@nextcloud/axios'
 import { showSuccess, showError } from '@nextcloud/dialogs'
+import { loadState } from '@nextcloud/initial-state'
 
 export default {
 	name: 'AdminSettings',
@@ -146,6 +147,7 @@ export default {
 
 	data() {
 		return {
+			isAdmin: loadState('approval', 'is-admin'),
 			showRules: true,
 			newTagName: '',
 			rules: {},