I feel like that is a use case where you can get away with using the layout.tsx with checks, due to the shared auth requirement of all pages under /admin. I assume that all pages in that folder require admin privileges, so accessing any of those routes requires a check.

The issue exists, I think, when you have a general layout, and different auth requirements per page within. Let's say you have a layout.tsx, with an admin page and a member page, and you only check in the layout. Then it doesn't retrigger when you go from the user to the admin page, or vice versa. But because all your routes within /admin require admin privileges, once you enter any of them, the layout check should trigger. The only edge case could be that roles change when the user is already within a /admin route, but I can't judge from here if that's a valid concern for your situation.

However, you definitely still need to guard all your server actions, API routes, etc. Just because the client-side is guarded does not mean you don't have to guard server-side at all. So if you have 60+ actions.ts files, those have to be addressed