Current behavior

Forge Confluence apps currently have no supported way to confirm whether the user invoking a resolver is a Confluence site admin or space admin. Manifest displayConditions only control whether a module's UI is shown - they don't restrict who can invoke the underlying resolver, so a non-admin user can still call a resolver directly.

Unlike Jira (which offers myPermissions/bulk permissions APIs), Confluence has no equivalent that lets an app check the invoking user's admin permissions. As a result, admin-only actions exposed through modules like confluence:globalPage can't be properly authorized inside the resolver.

Suggested behavior

A supported way for a Forge app to verify the invoking user's Confluence admin permissions from within a resolver. For example, either by extending the Forge Authorize API with Confluence admin checks, or by providing a Confluence permissions API equivalent to Jira's.