Yes, using Security Rules is exactly what I want to do. However, I cannot figure out how to create a rule based on another custom Security Level rather than on a Role ( {user:roles}) or Security Zone ({security-zones}).
To make my question more clear, let’s use the example from my original post.
I want to create a rule for PlantB/Intern that grants access to:
users with the PlantB_Intern role
AND users already in the PlantA/Manager security level
So the rule would look something like this:
containsAny({user:roles}, 'PlantB_Intern') || <something I don't know>
For this example, let’s assume the PlantA/Manager security level is defined by some complicated expression and not simply by the PlantA_Manager role.