Admins should be able to deny permissions to anyone, even ops. the default: op bit in plugin.yml gives this permission to ops by default