- name: profile-does-not-grant-admin
  where: "profiles/update.go"
  ensure: >-
    Applying an ordinary profile patch must leave IsAdmin unchanged. It must not grant administrative access.