Lokesh ,
I understood your query and agree with Alex response.
If there is need to give direct authorizations(non-org level) to derive role then without disturbing master - derive role ,you may create single role which accommodate only extra access (doc type 4,5,6) and use this single role along with derive role for composite role assignments and user assignments .I feel this is feasible if it is couple of derived role changes , not many.
Thanks,Krishna