fix up the custom cloud-admins rule