Thanks for the explanation @pdpinch.
I don’t think in this a good use case for the (to be contributed) Access Control Backends.
What I would do is to refactor the Enrollment API to match your needs. I usually get away with such hard-coded changes in the platform core by writing new tests and surround my new code with feature flags so it survives release upgrades. Sometimes it doesn’t survive but it breaks loudly – thanks to tests – which makes it easier to fix.