(I guess you'd have to have

(normal_permission - is_admin) + admin_block_permission

to allow admins to block other admins)