icacls C:\inetpub\wwwroot\mysite\ /grant:r "IIS APPPOOL\mywebsitepool":(OI)(CI)(RX)

guarantees that new files & directories put into this folder inherit the permissions that were set for the parent folder.

 More details on IIS7 Application pool isolation can be found here: