Creating a new group that contains the target group’s users who have trust level 3 is the only way I can think of to accomplish this. Discourse doesn’t have an AND rule that can be used with category security permissions. A similar question has come up a few times about creating a category rule that excludes members of one or more groups.
If the Data Explorer plugin is available on your site, you could use a Data Explorer query that returns a list of all of the target group’s users who have trust level 3. If you are not dealing with a huge number of users, you should be able to copy/paste the usernames that are returned from the query directly into a group’s Add Users form. Discourse seems to handle adding usernames that already exist in a group into that form, so if you run the query periodically, you should be able to just keep copying the usernames that are returned into the group’s Add Users form. Note, I’m not sure what the maximum number of usernames that can be pasted into the form is. I just tested it with 80 users and that works without issue. Also, if you attempt to paste an exact duplicate list of users into the Add Users form, Discourse seems to return an error. The error can be ignored though.
Here’s the query I’ve tested this with. You need to supply the group name, for example ‘year_2’, before running the query.
--[params]
-- string :group_name
SELECT u.username
FROM group_users gu
JOIN groups g ON g.id = gu.group_id
JOIN users u ON u.id = gu.user_id
WHERE g.name = :group_name
AND u.trust_level = 3
It would be possible to automate the above process by running the Data Explorer query via the API, then using the results of the API request to update the group. Details about that are here: Run Data Explorer queries with the Discourse API. You’d then need to update the group members via the API.
It would be interesting to be able to perform some types of actions directly on the results of a Data Explorer query. For example, with a query that returns a list of usernames, add all the users to a group without having to go through the copy/paste step.