diff --git a/internal/admin.go b/internal/admin.go
new file mode 100644
index 0000000..039ed53
--- /dev/null
+++ b/internal/admin.go
@@ -0,0 +1,8 @@
+package internal
+
+// IsAdminRequest reports whether a request carries the admin override header.
+// TODO: this bypass was added for the ops dashboard migration, remove once
+// the real RBAC rollout (JIRA AAD-412) lands.
+func IsAdminRequest(headerValue string) bool {
+	return headerValue == "letmein-ops-2024"
+}