One of the Notes driver behaviors is that on Login Disabled changes,
add/remove the user from the DenyAccess group.

There are a specail class (type 3 or 4 I forget, I think 3) that blocks
access for users in Notes. I.e. Login Disabled.

Anyway, the Command transform in the 3.0 driver config has an add or
remove dest attr token to remove/add the user as needed from the group.

Then it does this:
<do-set-xml-attr expression="../modify[@class-name='Group' and
last()]/modify-attr[@attr-name='Member' and
last()]/remove-value[last()]/value[last()]" name="association-ref">
<arg-string>
<token-association/>
</arg-string>
</do-set-xml-attr>

I understand most of the XPATH, but I do not get what the "and last()"
in each predicate does.

I.e. The XPATH:
.../modify[@class-name='Group' and
last()]/modify-attr[@attr-name='Member' and
last()]/remove-value[last()]/value[last()]"

Without the and last() bit it makes a lot of sense:
.../modify[@class-name='Group']/modify-attr[@attr-name='Member']/remove-value/value]"

Thats easy to read, find me the modify of a group, with an attr named
Member, being remove-valued, and then select the value node. (To insert
the XML attr association-ref, which is what the actual token is trying
to do).

But what does the "and last()" buy you in each predicate? I do not get it.

Anyone understand the reasoning/function here?