Hi Daniel if I understand correctly the answer for your question it's either user "Building Blocks" (BB) and/or "Reference Sets", where BB was an older approach to solve this and Reference Sets it's a newer approach.
For example on a search on the Log Activity you can use it like this:
When adding the filter you need to search the parameter "Reference Set", then you search "Data Entry" on this case the user.
On this example my the Reference Set "IT Admins" has two vaules "root" and "admin", and the result it's the following.
For rules you can use the test "when any of these event properties are contained in any of these reference set(s)", something like this:
The reference set management UI it's on the Admin tab.
Hope that this will help you.