revokeTutorRights(ident username, ident exerciseId, ident groupId) {
  assume exists //accounts/account[username]/tutor[exerciseId]/group[groupId]; # implies the account exists, which is implicitly true anyway
  assume exists //exercises/exercise[exerciseId]/groups/group[groupId]/tutor[account]; # implied by integrity and the assumption before
 
  remove //accounts/account[username]/tutor[exerciseId]/group[groupId];
  if size(//accounts/account[username]/tutor[exerciseId]/group) = 0 then # should this be an additional procedure?
    remove //accounts/account[username]/tutor[exerciseId];
  fi
  remove //exercises/exercise[exerciseId]/groups/group[groupId]/tutor[account];
}