revokeAdminRights(ident uid, ident username) { assume exists /account[uid]/admin; assume exists /account[username]/admin; # implies the account exists, which is implicitly true anyway assume size(/account/admin) > 1; # kind of a practical constraint remove /account[username]/admin; }