Is it possible for admins to store data on users but not allow the user to update that data?

I think you are looking for this feature: https://github.com/ory/kratos/issues/117

No, I don't want it immutable. What I'd like to do is have an admin configure some data on users. We use OPA for authz, which isn't the most user friendly experience for admins. I'd like to set an initial OPA policy that says something like "allow any user to do X when the user's foo == bar" and where "foo" is data from Kratos.

What about this feature: https://github.com/ory/kratos/issues/47

That sounds exactly like what I'm looking for.