The AI change that made approving a node-role device pairing an admin action placed the new check inside a branch that only runs for callers with a known device identifier, so sessions without one skipped it. The repair runs the check for every non-admin caller.

The commit that introduced the rule added a helper that reads the roles a pending pairing asks for, and denies the approval with a role-management-requires-admin reason when any requested role is not operator. That denial was written into the block that already handled ownership, which opens only for a caller that presents a device identifier and is not an administrator, so the new rule inherited the older condition and sessions without a device identifier kept approving node-role pairings. A later commit by a maintainer changes the enclosing branch to test only whether the caller is an administrator, and moves the device-identifier test into the ownership comparison, so the role rule now reaches every non-admin caller while the ownership rule still applies only where it can be evaluated.