In Portal 2.4 (you never said which version of the portal you are using), the tabs that appear in the navigation portlet correspond to the pages to which the user can navigate. Hence, since 'admin' can navigate to the 'Admin' page, when logged in as 'admin' you see the 'Admin' tab, otherwise you don't.

You can do similar things by defining roles that ca see specific pages. For example, role 'one' can see pages 'aaa' and 'bbb', while role 'two' can see pages 'aaa' and 'ccc'. Then if user 'joe' is in role 'one' and role 'two', 'joe' can see all three pages (all thre tabs show in the navigation portlet). If user 'sue' is only in role 'two', then 'sue' can see only pages 'aaa' and 'ccc' (only those two tabs show in the navigation portlet.