package user.read default allow := false allow := true { input.uuid == input.owner } allow := true { input.role == "admin" }