diff --git a/admin/includes/inc_all_admin.php b/admin/includes/inc_all_admin.php
index 8c051fba..9953cd6b 100644
--- a/admin/includes/inc_all_admin.php
+++ b/admin/includes/inc_all_admin.php
@@ -4,9 +4,7 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/config.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/functions.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/check_login.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/page_title.php';
-if (!isset($session_is_admin) || !$session_is_admin) {
-    exit(WORDING_ROLECHECK_FAILED . "<br>Tell your admin: Your role does not have admin access.");
-}
+enforceAdminPermission();
 require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/header.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/top_nav.php';
 require_once 'includes/side_nav.php';
diff --git a/admin/post/update.php b/admin/post/update.php
index 37ef8021..6099a858 100644
--- a/admin/post/update.php
+++ b/admin/post/update.php
@@ -4,7 +4,7 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
 
 if (isset($_GET['update'])) {
 
-    validateAdminRole(); // Old function
+    enforceAdminPermission();
 
     //git fetch downloads the latest from remote without trying to merge or rebase anything. Then the git reset resets the master branch to what you just fetched. The --hard option changes all the files in your working tree to match the files in origin/master
 
diff --git a/agent/custom/index.php b/agent/custom/index.php
index 558c87ae..d97afaa0 100644
--- a/agent/custom/index.php
+++ b/agent/custom/index.php
@@ -13,7 +13,6 @@
     <hr>
     <p>This is a great starting point for new custom pages.</p>
     <h1><?php echo $session_user_role; ?></h1>
-    <?php validateAdminRole(); ?>
 
 <?php
 
diff --git a/agent/reports/recurring_by_client.php b/agent/reports/recurring_by_client.php
index 8727e825..b2bc21b6 100644
--- a/agent/reports/recurring_by_client.php
+++ b/agent/reports/recurring_by_client.php
@@ -2,7 +2,7 @@
 
 require_once "includes/inc_all_reports.php";
 
-validateAccountantRole();
+enforceUserPermission('module_financial');
 
 $sql = mysqli_query($mysqli, "
     SELECT client_id, client_name,
diff --git a/functions/auth.php b/functions/auth.php
index 068966ae..4ebe43f8 100644
--- a/functions/auth.php
+++ b/functions/auth.php
@@ -3,36 +3,6 @@
 // Role and permission enforcement
 // Split from the former monolithic functions.php
 
-
-/*
- * LEGACY Role validation
- * Admin - 3
- * Tech - 2
- * Accountant - 1
- */
-
-function validateAdminRole() {
-    global $session_user_role;
-    if (!isset($session_user_role) || $session_user_role != 3) {
-        $_SESSION['alert_type'] = "danger";
-        $_SESSION['alert_message'] = WORDING_ROLECHECK_FAILED;
-        header("Location: " . $_SERVER["HTTP_REFERER"]);
-        exit();
-    }
-}
-
-// LEGACY
-// Validates a user is an accountant (or admin). Stops page load and attempts to direct away from the page if not (i.e. user is a tech)
-function validateAccountantRole() {
-    global $session_user_role;
-    if (!isset($session_user_role) || $session_user_role == 2) {
-        $_SESSION['alert_type'] = "danger";
-        $_SESSION['alert_message'] = WORDING_ROLECHECK_FAILED;
-        header("Location: " . $_SERVER["HTTP_REFERER"]);
-        exit();
-    }
-}
-
 // When provided a module name (e.g. module_support), returns the associated permission level (false=none, 1=read, 2=write, 3=full)
 function lookupUserPermission($module) {
     global $mysqli, $session_is_admin, $session_user_role;
@@ -67,6 +37,15 @@ function lookupUserPermission($module) {
     return false;
 }
 
+// Enforce admin portal access - single canonical admin gate ($session_is_admin)
+function enforceAdminPermission() {
+    global $session_is_admin;
+    if (!isset($session_is_admin) || !$session_is_admin) {
+        exit(WORDING_ROLECHECK_FAILED . "<br>Tell your admin: Your role does not have admin access.");
+    }
+    return true;
+}
+
 // Ensures a user has access to a module (e.g. module_support) with at least the required permission level provided (defaults to read)
 function enforceUserPermission($module, $check_access_level = 1) {
     $permitted_access_level = lookupUserPermission($module);