Make a "junior admin" (or similar):
- give "junior admins" ability to block non-admins (with a rate limit) up to 30 minutes,
- give admins ability to block any non-beuarocrat etc. for up to 30 minutes (an admin could block another admin, which can do the same while blocked by this mechanism),
- both of those can be extended by any user once,
- give "junior admins" (rate limited) ability to "kick" (log out) any user - they can log back in without waiting unless *1,
- a user can be banned according to these rules once every 24 hours,
- an admin can override the rate limits
In case of:
- admin go rouge,
- vandalbot,
- libel, diclousure,
- compromised account
- etc.
--
Make autoconfirmed IP: an IP who edited enough times in last 14 days (and no abuseFilter, not counting reverts...) can be marked (watchlist, RC, userrights only) - I have seen IPs with a lot of contributions of high quality