Only admin should be able to add a particular custom field

The way I would approach this is:

1. Create a custom field with an underscore in front of it – Example: _rating this way it doesn’t show up in the normal custom field interface
2. Create a meta box that manages this custom field
3. Wrap your add_meta_box function with if(current_user_can(‘administrator’))

This will only create the meta box if a user is an administrator. It’s not a fireproof method unless you disable the custom field interface.

If this is a plugin you can use remove_meta_box if the user is not an administrator before the post edit page renders.