In case anyone else runs into this. (How could you not?)
I recently federated an AGS with Portal. All of the items were registered as expected. I used the Portal web UI to share items with a group. The item details indicated that the items were shared with the group.
Now the issue emerged: THEY WERE NOT ACTUALLY ACCESSIBLE
But then I poked around and found that if I connected to the Portal in ArcMap and shared the items they are now accessible to the group as expected. Thankfully there is a way, without republishing everything. But esri, if you're listening: please please fix this.