https://ones.com/ja/blog/admin-privilege-revocation-security-2