[qwertox]

Not admin access:

> Calea provided options are available only for specific RouterOS user, as Calea server configuration as "tap" configuration. Specific user should have 'sniff' policy enabled at RouterOS user configuration

So the admin has to set up a user account on the device.

[vetinari]

On RouterOS, the default 'admin' user is a member of the 'full' group, which has 'sniff' policy enabled.

So it can be both - dedicated user with the appropriate permission, or admin himself.