ATProto's tbd permission system is insufficient for the granularity needed in enterprise. Many of those features needed (like groups) will have to be built in an app view and by proxy be centralized. ACLs are two generations in the past of IAM history

Chat is also not a great modality for the PDS/ATP, Roomy learned this and is building a dedicated protocol and bridge.