auth/opa/user/read.rego

package USER.READ

default allow := false

allow := true {
    input.uuid == input.owner
}

allow := true {
    input.role == "admin"
}