BEGIN;

DELETE FROM role_permissions rp
USING roles r, permissions p
WHERE rp.role_id = r.id
  AND rp.permission_id = p.id
  AND p.code = 'user:password:reset:any'
  AND (
    (r.name = 'Admin' AND r.is_system = TRUE)
    OR (r.name = 'SuperAdmin' AND r.tenant_id = '00000000-0000-0000-0000-000000000001')
  );

DELETE FROM permissions
WHERE code = 'user:password:reset:any';

COMMIT;