How to use a set of global and per subsite permissions in a multisite installation?
For now I solved this by creating a seperate global role which stays in the default shared config. I added the editor role to the conditional (graylist) section (configured per subsite) using config_split. So that way I am able to have seperate permissions for that role.

That global role can be automatically assigned to a subsite user during a new subsite install via a bash script/drush command for example.