Another possibility is to create a news folder for each mounted package instance and drive permissions that way, despite the earlier design.
This would be more consistent with the intended use of the CR anticipated in its design. News isn't the only package that only creates a single folder, though.
Probably worth thinking about ... especially since there's a fair amount of sentiment to legitimatize use of context_id as a physical parent_id (though that issue's not settled and the CR does have an explicit parent_id in its datamodel).
