So could the security_inherit_p just be a flag to the same proc to loop over the necessary inserts?
Security inherit is the default now, isn't it? In ad_proc format:
ad_proc some_context_setting_proc {
{-object_id}
{-context_id}
{-security_inherit_p "true"}
} ...
which would just wrap the pl procedure taking the three arguments. Or optionally you could specify the number of levels up the hierarchy to go. Zero would be the same as setting security_inherit_p to "false", -1 could imply all the way up??? Some positive number would indicate an intermediate inheritance. So something like -inherit_levels "-1" would be the default.