Consumers being required to have read access for interactive reports has broken our security model

We allow business area authors to develop reports in the production environment.  Business area consumers only run reports
Business area authors have Report Studio capability, Read, Execute, Traverse to the business area reporting package, and at least Execute, Traverse to their business area reports
Business area consumers have Execute, Traverse to the business area reporting package and Execute, Traverse to their business area reports
This worked for us from Cognos 8.1 - Cognos 10.2.2.  The way Cognos 11 added the new report interactivy security has "broken" our security model.  Consumers now have to have read access to any packages in their business area that have interactve reports.
Consider
User1 is a business area author for the Accounting package and a consumer for Sales reports (using the Sales package).
User2 is a business area author for the Sales package and a consumer for Accounting reports (using the Accounting package.
Interactive reports are added to both the Accounting and Sales areas, so consumers need read access to the respective packages.
Since both User1 and User2 have Report Studio capability for their respective business areas, they now have Report Studio for the business area package that they should not have authoring capabilities for.
At this point, Cognos support and our AVP contact have not been able to give us a solution or workaround for this.
Possible solutions 
Instead of requiring read access for interactivity, just make it part of the execute permissions
or
Add a new capability for interactivity that doesn't allow report studio access