hi Jason,
does that mean that you want the following use cases:
As an admin user I want to see movies having year >= 2000 (I missed the equal sign in your aggregate to support the year 2000)
As an adminUnder user I want to see movies having year < 2000
As another user I want to see all movies.
and perhaps As a user with admin and adminunder role I want to see all movies.
you can accomplish that with the following filter:
// show movies with year >= 2000 for Admins
CheckAdminRole() and Movie.Year >= 2000 or
// show movies with year < 2000 for AdminsUnders
CheckAdminUnderRole() and Movie.Year < 2000 or
// show movies for users without those roles
not (CheckAdminUnderRole() and CheckAdminRole()) or
// show movies for users with admin and AdminUnder
RoleCheckAdminUnderRole() and CheckAdminRole()