'Removes a role assignment from a user account
@param user_id: the record ID of the user account
@param group_id: the record ID(s)/UID(s) of the role
@param for_pe: only remove the group membership for this
realm, possible values:
- None: only remove for the default realm
- 0: only remove for the site-wide realm
- X: only remove for entity X
- []: remove for any realms
@note: strings are assumed to be role UIDs'

def s3_withdraw_role(self, user_id, group_id, for_pe=None):

    if (not group_id):
        return
    db = current.db
    gtable = self.settings.table_group
    mtable = self.settings.table_membership
    query = None
    if isinstance(group_id, (list, tuple)):
        if isinstance(group_id[0], str):
            query = gtable.uuid.belongs(group_id)
        else:
            group_ids = group_id
    elif isinstance(group_id, str):
        query = (gtable.uuid == group_id)
    else:
        group_ids = [group_id]
    if (query is not None):
        query = ((gtable.deleted != True) & query)
        groups = db(query).select(gtable.id)
        group_ids = [g.id for g in groups]
    query = (((mtable.deleted != True) & (mtable.user_id == user_id)) & mtable.group_id.belongs(group_ids))
    sr = self.get_system_roles()
    unrestrictable = [str(sr.ADMIN), str(sr.ANONYMOUS), str(sr.AUTHENTICATED)]
    if (for_pe != []):
        query &= ((mtable.pe_id == for_pe) | mtable.group_id.belongs(unrestrictable))
    memberships = db(query).select()
    for m in memberships:
        deleted_fk = {'user_id': m.user_id, 'group_id': m.group_id}
        if for_pe:
            deleted_fk['pe_id'] = for_pe
        deleted_fk = json.dumps(deleted_fk)
        m.update_record(deleted=True, deleted_fk=deleted_fk, user_id=None, group_id=None)
    if (self.user and (str(user_id) == str(self.user.id))):
        self.s3_set_roles()
