ok, I was assuming there was there was an internal network (10.1.1.0/24) and admins on another network should be reach the entire subnet while staff on another newtwork can only access a single ip