When denying permission to write to an user, that user can still modify acces rights

When a user from the administrators group revokes the right to write for a document, that user loses the ability to modify that document. But he still has the ability to manage access rights (WriteAccess) and he can grat himself back the right to write on that document and then write in it(modify it).

What can be done is when a user revokes the Write right, automatically the Write Acces right must be revoked - maybe a hierarchy of dependent rights may be constructed.