revokeAdminRights(ident uid, ident username) {
  assume exists //accounts/account[uid]/admin;
 
  assume exists //accounts/account[username]/admin; # implies the account exists, which is implicitly true anyway
 
  assume size(//accounts/account/admin) > 1; # kind of a practical constraint
 
  remove //accounts/account[username]/admin;
}