User blog comment:DaNASCAT/Technical Update: March 7, 2016/@comment-452-20160309181929

Admins can now lock out bureaucrats.


 * 1) Log in as a bureaucrat
 * 2) Promote a testing account to admin
 * 3) Remove all rights from first account except bureaucrat
 * 4) Log in as the testing account
 * 5) Block the first account
 * 6) Log back in as the first account
 * 7) Observe that neither Special:Unblock/(username) nor Special:UserRights/(username) can be accessed from the blocked bureaucrat account.

Is there something I've missed? What is the purpose in bureaucrats having "unblockself" if Special:Unblock cannot be accessed?

It's possible that the unblock command can be sent from the API, but since most bureaucrats aren't going to know how to do that, I haven't tested it.

The order of rights removal is screwed up.


 * 1) Be a bureaucrat, administrator, rollback, Content Moderator, Discussions Moderator and Chat moderator
 * 2) Uncheck all but bureaucrat and submit page
 * 3) Observe that only administrator, rollback, and Content Moderator were removed, and Discussions Moderator and Chat moderator remain, despite having been unchecked.