We need to create a role that would:
- generally be only able to edit content in specific language (i.e fr-fr, regional author)
- except items based on template A where they also should be able to edit en version.
Does this seem feasible?
I tried creating one role that has language:write for French and another that is only able to edit items based on a template A + has language:write for en but a user that is member of those two is able to edit all en content.
If I understand your requirement, user wants to edit all the items in "fr-fr" version and just "template A" items in "en" version which is not feasible with the out of box Sitecore Security module.
You can create a role that would generally be only able to edit content in specific language.
At any point if you want to edit even a single item in a specific language version then that user should get the "Language Write" access directly or indirectly through any role.
In your case user should able to edit "fr-fr" and "en" version of "template A" items, so you may need to give "Language Write" access to the user [directly/through one/multiple roles] for both the languages.
Once you set "Language Write" to two languages then whatever security you set at item/folder/site/template standard values level that will be applicable to both the languages because the __Security field is a "Shared" field and it's not an "Unversioned" field to have different value for each language. If you enable write access to all the items then both fr-fr and en versions are editable and if you disable write access then both en and fr-fr versions are write restricted.
Not recommended, But for example you can have the custom security check in the Workflow action and stop the item to be moved to the next state if it's mistakenly updated by the user who really should not. Or something similar to this check in different pipeline/processor and stop getting saved/published also show a proper error message to the users.
