yes security assist can do these things.
You may find the information in the "User Level Authentication" tutorial in the archived documentation section helpful (It was written for SA1, but still applies to SA2)
The user level concept can be adapted to an agency.
The key's to getting this to work will be the UserID session variable that is set at login and the UserLevel session variable. and storing these values with the listing when it is inserted.
to upload the image when submitting the listing, you would use the file Manipulation functions included with Universal Email 4 or Form Builder 2