Personally, I think the best system would just be to have the same one as right now, only to allow commands to set individual rights for each level instead of just level X and up. This would mean no new tables or fields.
For example, a command that only supports level 4 right now would just be "4" in the commands table, but a command that supports security >= 1 would be "1 2 3 4", and if you wanted it to be for 1, 2, and 4 only it would be "1 2 4". Simple, easy.
It would also mean it could be done in a simple mangos DB update; i.e.
-- changes security column to string, then...
UPDATE commands SET security = "0 1" WHERE security = "1";
UPDATE commands SET security = "0 1 2" WHERE security = "2";
etc, etc
No adding up flags, no crazy letter system. If you guys like it, I could make up a patch for it.