Imagine you have a track named 'level' with something like (with group parenting set up accordingly):

level: default ---> verified ---> assistant  ---> boss  ---> admin ---> op ---> root

Now assume that e.g. bosses should be allowed to promote default ---> verified ---> assistant, so:

/luckperms group boss permission set luckperms.user.promote true

The problem with this, of course, is that bosses can also self promote beyond and become e.g. admin ---> op ---> root - which one typically probably would never want (it's like a "privilege escalation 'attack'").

Unless I'm missing something, I think there is an easy solution to this, not requiring any complicated customizable rules or anything: if you just limited promote to never be able to self promote beyond one's current group membership?

With this, bosses could still promote, and someone who is already e.g. an admin could still raise someone who is a boss up to become an admin, but couldn't make himself an op or root.

Also, for the initial set up, any group with permission set * true should still be able to change others to promote to any group in a track, as should commands typed into the console.

I guess you could even have an additional new permission named perhaps something like luckperms.user.promote.unlimited, which would give the current behaviour, although I don't even think that's really necessary.

solution?

I'll write up a wiki page soon.

Has that wiki page been written yet?

No

Finally 🙌

One month later @Coolfeather2 😅

https://github.com/lucko/LuckPerms/wiki/Argument-based-command-permissions

Still not working. My server has one track named default and even when I add luckperms.user.promote..<old/new-group> it does not let me execute the command. And I do have the option enabled in the config.
My default track goes default--->member--->trusted---->moderator--->admin---->owner
I want it so that the user inheriting trusted or higher can promote/demote players up to the group below them.
i.e. for moderator, I put, luckperms.user.promote.default.trusted, luckperms.user.demote.default.member, and for trusted I put luckperms.user.promote.default.member, luckperms.user.demote.default.default,
When I add the luckperms.user.promote/demote nodes to any group, they can still promote all the way up to owner, and when I take the main luckperms.user.promote/demote off, they can't even run the command at all.
I just want the equivalent of essentials.membership.manage.

edit: im running luckperms V5