Actually since the operator="replace" is on the <user> element, I think at most one <user> would be replaced.Another valid-but-wrong interpretation would be replacing all users.
IMHO, the selection keys (i.e. identifiers) should be explicit rather than making any assumptions that the target system knows which elements are keys. There are several advantages to going this route:The interpretation depends on the understanding of identifiers (identifying elements), but how should this be expressed inside the protocol? Or does it need to be, given that code handling users will either know what the identifiers are or learn them from the schema file?