https://ones.com/ja/blog/administrator-privilege-revocation