deleteAccount(ident uid, ident username) {
  assume exists //accounts/account[uid]/admin;
  assume uid != username; # or do we want to allow an admin to delete himself?
 
  assume exists //accounts/account[username];
 
  assume size(//accounts/account[username]/examiner) = 0;
  assume size(//accounts/account[username]/assistant) = 0;
  assume size(//accounts/account[username]/tutor) = 0;
 
  # not yet a constraint of the implementation, but is seems practically relevant :-)
  if exists //accounts/account[username]/admin then
    assume size(//accounts/account/admin) > 1;
  fi
 
  if exists //accounts/account[username]/student then
    assume size(//exercises/exercise/students/student[//accounts/account[username]/student/id]) = 0;
    assume size(//exams/exam/results/participant[//accounts/account[username]/student/id]) = 0;
  fi
 
  remove //accounts/account[username];
}