to create derived role, create a role as normal & in the description tab put the name of your parent role in field "Derive from role". Enter your org restrictions and then go back to your master/parent role and push through the object level changes from the Authorizations tab of the master role (I think the button is titled "adjust derived")
