auth/opa/user/delete.rego

package USER.DELETE

default allow := false

allow {
	input.id == input.owner
}

allow {
	input.role == "admin"
}