Administrators can have their access to documents restricted just like any other user.  The caveat is that the "Manage Entry Access" privilege (which an administrator will likely have) allows users to see - but not read - all entries in the repository, and it also gives the ability to change access control on any entry.  So it is possible for an administrator to grant himself rights to see any entry.  The typical solution for this would be to audit changes in entry access rights or read events on the record.