Hi Vincent,
I think using permissions, relationships and groups may be less scalable than using the package awareness of OpenACS applications. Please have a look at the data model of OpenACS and ticket tracker. Unless you want a very granular security model I suggest not to use grouping and permissions on the ticket level.
Regarding the central administration of the tickets you may want to create some custom pages that will show you tickets regardless of package_id.
My approach is like removing rather than adding functionality.
