revoke-only-administer-permission.tcl