Couldn't you create a security file for a generic role named CuteEditor. Then if that role did exist and users were assigned to it they would get permissions granted by the referred to security config file?

 

And is there a way to specify a root folder when using UseDNNRootImageDirectory="true"? The config files seem to have no impact with this.