Does this work? If yes, problem.
1: global_admin creates a user in his own organization
2: this user becomes organization_admin
3: the organization_admin deletes the global_admin

Add another rule: organization_admin may not even modify a global_admin