Guidelines to decide when a domain role needs to be explicitly modelled

I looking for some guidelines as to when one must explicitly model a role in the domain model.
 I will explain my current stance with the help of an example here.
 Say we are building a health care system, and the business requirement states
 "That only doctors with 3+ years of experience and certain qualifications can perform surgeries"
 In this case it is evident that the act of doing a surgery can only be performed by a person playing the role of a doctor and the doctor needs to meet certain prerequisites to perform the action
 docter.performSurgery() 
 So basically all doctors are not the say
 This method will probably check if the preconditions are met, else i might use a specification object.
 So in the above cases, I will model the role explicitly.
 Now lets consider the alternate scenario.
 Only a admin can approve of a funds transfer
 In the above case I do not find any need to model this role in domain, as their are no rules distinguishing one admin from another in my domain.
 Any person/userlogin with the permission of admin can perform this action, I would rather design this into my security infrastructure and ensure that the
 approveTransfer() method invoked on the application layer is invoked only if the currently logged in user has the ADMIN permission.
 So the "domain model" by which i mean classes like the Account class and unaware of this rule, this is codified in the application layer either via AOP or probably the AccountService class or the like.
 
 What do the wise men have to say about this ? :)