Hi Daniel
I think it should be possible by creating a single role restricted on the PSA and giving it display access only and assigning it to the composite role of HR admin who has the maintain access for other PSA.
Example :
1. Maintain access for PSA 1000 + Display access of PSA 2000 in two different roles and provided to the HR admin/ user.
2. Maintian access for PSA 2000 + Display access of PSA 1000 n two different roles and provided to the HR admin/ user.
So for each PSA two single roles can be created one with maintain access & one display access and the combination should be provided as per the requirement of the HR admin. Try it shold work.
best wishes
V