Just a small thing to note: I think this won't work for superusers if anyone ever tries to chain it: it'll only remove the last permission.