See also the SDS work linked here:
Long story short, a group holds a DID on a custom PDS that manages permissions to that DID’s repos.