I just had to learn this by asking sam. Since not everyone is lucky enough to share an office with sam, I thought I would put it here:
If you want to programmatically set up an availability condition (e.g. set an activity to only be available to users of a particular group, the best code to do that is:
$restriction = \core_availability\tree::get_root_json(I also added this to https://docs.moodle.org/dev/Availability_API. I hope that helps somebody.
json_encode($restriction), ['id' => $cmid]);