Operations to revoke rights are the only transactions
which are executed without asking consent
from the place in question.
There are two operations relevant here.
The normal revoke operation
and i-call-you!, which is not yet exported.
i-call-you! is good if a place runs wild for any reason.
If we can avoid it's use alltogether (except for the setup,
where is has the crucial role to create the basic right relation)
that would be a good thing.
This function is not yet available outside at the client code level.
Until that you need to start with debug-access enabled
and prepare the call by hand.