Instead of building this in to every package, if there was an admin page or, better a Tcl proc which could do this, then package maintainers could just add a callback for install, and current users could use the proc to provide the same consistency for older versions of a package.
Rel segments are great for finding who can do what using an explicit and simple query, but as a related question, how are admin permissions granted on package objects in the usual case? Is there a document that suggests usage of context_id, etc.?