diff --git a/server/directives.go b/server/directives.go
index b141a56311c1f51a69d66c15920f7fd76521bdef..17f60c1b88603856b444b0eb472ea30d2a3ead5f 100644
--- a/server/directives.go
+++ b/server/directives.go
@@ -9,6 +9,16 @@
 	"git.sr.ht/~sircmpwn/core-go/auth"
 )
 
+func Admin(ctx context.Context, obj interface{},
+	next graphql.Resolver) (interface{}, error) {
+
+	if auth.ForContext(ctx).UserType != auth.USER_TYPE_ADMIN {
+		return nil, fmt.Errorf("Access denied")
+	}
+
+	return next(ctx)
+}
+
 func AnonInternal(ctx context.Context, obj interface{},
 	next graphql.Resolver) (interface{}, error) {