revokeAdminRights(ident username) {
  assume exists //accounts/account[username]/admin; # implies the account exists, which is implicitly true anyway
 
  remove //accounts/account[username]/admin;
}