library of documents that would need to be secure and permission based. Sounds like something we'd need to write custom.
this is exactly what the Shared Files feature is for. You put it on a page protected by roles and then only role members can download the files. You can use different instances of Shared Files on different pages with different roles.
If you need something where the roles are different per file then you would need to implement something custom, but if you can group them into collections by which roles should have access then Shared Files is a good solution.
But again it is specifically for downloads not for files like images embedded in content. I mean you could copy the download link for a file from Shared Files and use that link in content (Html content feature for example), but the user will only be able to download the file if he has view permissions on the page where the Shared Files instance is located.
Hope it helps,
Joe