diff --git a/tests/test_litellm/proxy/auth/v2/test_management_endpoints.py b/tests/test_litellm/proxy/auth/v2/test_management_endpoints.py
index 8270a830d7d..d926b07c0a5 100644
--- a/tests/test_litellm/proxy/auth/v2/test_management_endpoints.py
+++ b/tests/test_litellm/proxy/auth/v2/test_management_endpoints.py
@@ -1,4 +1,34 @@
-from litellm.proxy.auth.v2.management_endpoints import rule_to_row_data, row_to_rule
+from types import SimpleNamespace
+
+import pytest
+from fastapi import HTTPException
+
+from litellm.proxy._types import LitellmUserRoles
+from litellm.proxy.auth.v2.management_endpoints import (
+    _require_admin,
+    row_to_rule,
+    rule_to_row_data,
+)
+
+
+def test_require_admin_allows_only_proxy_admin():
+    # No raise for a full proxy admin.
+    _require_admin(SimpleNamespace(user_role=LitellmUserRoles.PROXY_ADMIN))
+
+
+def test_require_admin_blocks_non_admins():
+    # Privilege-escalation guard: only PROXY_ADMIN may edit policies. View-only
+    # admins and every other role (and no role) must be rejected with 403.
+    for role in (
+        LitellmUserRoles.PROXY_ADMIN_VIEW_ONLY,
+        LitellmUserRoles.INTERNAL_USER,
+        LitellmUserRoles.INTERNAL_USER_VIEW_ONLY,
+        LitellmUserRoles.TEAM,
+        None,
+    ):
+        with pytest.raises(HTTPException) as exc:
+            _require_admin(SimpleNamespace(user_role=role))
+        assert exc.value.status_code == 403
 
 
 class _Row: