match /users/{uid} {
  allow read, write: if request.auth.uid == uid
    || get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
}
match /access_requests/{id} {
  allow read, write: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin'
    || request.auth.uid == resource.data.uid;
}
match /delete_requests/{id} {
  allow read, write: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin'
    || request.auth.uid == resource.data.uid;
}
match /clear_data_requests/{id} {
  allow read, write: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin'
    || request.auth.uid == resource.data.uid;
}
match /audit_log/{id} {
  allow read, write: if get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == 'admin';
}