Spaces left a number of core authorization building blocks out of the protocol. Those will need to be implemented in "user space" and I expect a number of different approaches will be attempted. I also expect this to become fragmented.

I shared my vision for what it could have been in the first ATProto Private Data WG: https://www.youtube.com/watch?v=oYKA85oZc8U&t=3812s (basically Zanzibar, UCANN is also interesting) I have ideas for a new protocol that would be permissioned, more federated, but still draw on the good parts of atproto. It's geared towards small social (think discord server / facebook groups) than big social (most common apps we think of - with reposts, quotes, blocks - features I have sworn off).

The Bluesky team didn't join the conversation until pretty late and then picked their own proposal (blog post series, was not formal at that point).