I understand that getAdministrativeResourceResolver has been deprecated since 6.0 (valid risks for this change?) and a resource resolver has to be fetched by passing an appropriate system user.
But if you are accessing the resource resolver from a sling request object, what user is this resolver mapped to?
In AEM 6.x the method getAdministrativeResourceResolver has been deprecated , as it is considered a security risk by providing too broad of access. A best practice is now to create a Service User with only the necessary permissions and use the method getServiceResourceResolver to get a ResourceResolver. There is a full discussion on the Sling documentation: . In addition Yogesh Upadhyay provides a good tutorial on his blog: 
See this example HELPX article: https://helpx.adobe.com/experience-manager/using/querying-experience-manager-sling-cug.htm l
Hope this helps!
If you do request.getResourceResolver(), the user is used of the current session.
That is the recommended way, because the permissions are respected of the current user.