if i add a new admin in prod and then refresh sandbox, he'll be able to access SB, is that correct? OR do i have to add him in prod and separately in SB?