Sorry I haven't replied to this until now.
To have the security template applied every <period of time>, create a timer job that applies the template. Note though that when using timer jobs code might in some cases execute "too fast" wich can cause sharepoint exceptions (like "operation aborted"). Especially if you apply the security template in an async event receiver. A typical scenario for this would be that you use the event receiver to apply the template and use a timer job to create or update items that fires the event. Since async events always gets its own thread, so one thread running the template can cause exceptions for another thread running the same (or other) template. This is not specific thing for this code, but a problem for every type of code running in async event receivers. One solution to at least minimize this problem when using a timer job is to set the jobs thread to run in the lowest priority and also make that thread sleep a little while after an SPItem.Update().
Concerning the "kicker". I actually don't think that a person not familiar with SharePoint and its security model should be messing around with permissions. But yes, it is an interesting idea to write code that makes it simpler to modify the templates without having to login to the server and modify it there. But probably very complicated since the changes must be applied to all web fronts at the same time... Any ideas how to?
Thanks for asking questions!
