For example, maybe I have a circle called “Colleagues”, who are assigned a “Work Friends” role. I’ve decided that anyone with that role can participate in any posts I make about my work, whereas anyone outside of that circle wouldn’t even see it in their timelines.

That’s a good idea. Google Plus may have been a terrible platform, but the ideas behind it were solid.

However, ActivityPub does not guarantee such restrictions. If two people are on the same server, the server will decide whether or not to honour the request to only show federated posts as described by such rules. Bonfire servers may be able to hide such interactions and refuse to republish them according to your account policies, but if you respond/react to someone on another server, that other server will be the one deciding what interactions are permitted and republished, not Bonfite’s settings. This can lead to awkward situations where everyone but you can see the reply your coworker sent to a reaction you posted.

Without encryption (the way Circles does it), I don’t think ActivityPub servers should advertise these features, not without users being warned about the risks of federation when setting up such distinctions. Even with Circles there’s a risk of a malicious client sharing keys, but at least the unintentional data sharing doesn’t happen because of protocol level design incompatibilities.