config.remove. - Overview of the macOS Authorization Right

macOS 10.6 / 10.7 / 10.8 / 10.9 / 10.10 / 10.11 / 10.12 / 10.13 / 10.14

{
  'class' : 'rule',
  'comment' : 'Wildcard right for deleting rights.  Admins are allowed to delete any (non-wildcard) rights.  Root does not require authentication.',
  'k-of-n' : '1',
  'rule' : [
    'is-root',
    'authenticate-admin'
  ]
}