There is a role for that already. If you look under the Administrators, there is a Guest Pass Generator role there, and then you would tie an account from the Administrator Domains to that. It is a little clunky and not super clear, but that is how we have done it.