auth/opa/ad/update.rego

package AD.UPDATE

default allow := false

allow {
	input.owner == input.requester
}

allow {
	input.role == "admin"
}