In reviewing your scenario you can use Security Keywords to effectively solve your problem.
I would recommend the following for your scenario:
If not already completed, create a Keyword as the Security Keyword. [In my example I am labeling it HR View Access]
You can create a dataset for the Keyword to make sure they only index the values that are set as the Security Keyword Values [In my example: EMP and EMPEXEC (Be sure to check the keyword must exist option to make sure they are not able to freeform other values)
For the existing User Group that all current HR Employees are a member of [HR Employee Access] set the Security Keyword | HR View Access EQUAL to EMP
For the Group that requires access to Executive HR Documents if not already existing create a User Group
[HR Exec Access] add the Users needing access and set the Security Keyword | HR View Access EQUAL to EMP*
After the EMP there is an Asterisk(*) this will allow users in this group to see all Document Types were the HR View Access KW is equal to EMP and/or EMPEXEC.
Please remember that anytime you use an Asterisk(*) it may impact performance of your client, in your unique circumstance I do not think performance to be an issue. If others are reading this, be sure to test your solution prior to determine if using an Asterisk(*) impacts your solutions performance.
Based on the number of Users that require access to Executives Document Types you can also update the Security Keyword of the Individual User with the Security Keyword | HR View Access EQUAL to EMP*
No additional User Groups would be needed.
I recommend setting the default value for the Security Keyword you select for the Document Types to the most common value you would index, in my example: EMP this way you only need to update when setting other values.
Hope this helps.
Kevin
