In CE you'll need to use a teams-like solution such as https://www.sugaroutfitters.com/addons/securitysuite. Then cc, dd, and aa would all be added to the same teams (same wiht ee, ff, and bb). When cc and dd create a lead it will automatically be assigned to the same team so that aa can see the lead.
For security, a role would be assigned to the team to allow owner only access so that cc and dd only see their own leads (if your needs require this). Then the aa manager-type would be assigned a role with Team level access. In SecuritySuite that would be Group only access which gives the aa user access to his/her own records along with any records assign to aa's team(s).