...
The authorization delegate is not consulted when servlet credentials identify a client with the fedoraAdmin role. When the container has authenticated the connected client as a fedoraAdmin, all actions are permitted and we bypass the PEP completelyis bypassed.
FedoraAuthorizationDelegate Implementations
...