Can access arguments only be specified once for all sub-routes?
Basing on the documentation for hook_menu() access arguments are inherited from the parent route only if the access callback is inherited, and that only happens for MENU_DEFAULT_LOCAL_TASK routes.

For the code shown in the question, this would happen only if it would be written as follows.

function mymodule_menu() {
  $items['admin'] = array(
    'page callback' =&gt; 'drupal_get_form',
    'page arguments' =&gt; array('get_users_page'),
    'access arguments' =&gt; array('administer users'),
    'type' =&gt; MENU_NORMAL_ITEM,
  );

  $items['admin/users'] = array(
    'title' =&gt; 'Users Listing',
    'type' =&gt; MENU_DEFAULT_LOCAL_TASK,
  );

  return $items;
}


I take the route names are used just as example. Since admin is already defined from system_menu(), it is better not to use route names containing admin or admin/.

As side note, the page callback is inherited from the parent route, in any case.