This is a simple OPA policy written in Rego. For context check the Medium blog

salary-rego

package play

default allow = false

allow = true {
  input.method = "GET"
  input.path = ["salary",employee_id]
  input.user = employee_id
}

allow = true {
  input.method = "GET"
  input.path = ["salary",employee_id]
  input.user = employee_id
}

managers = {
  "gilfoyle": {"richard","erlich"},
  "richard": {"erlich"},
}

test_allow {
  allow with input as {"method": "GET", "user": "richard", "path": ["salary","gilfoyle"]}
}