Drag and drop accuracy aside, if there is the slightest chance that the user might drop the group on the wrong directory, you want to avoid that as tossing around permissions is probably not a good idea. I'd consider add a confirmation dialog box before executing the permission change. You might trap the movement of the dragged token and report the nearest target dynamically as text on the token, on a status bar, or maybe by highlighting the current nearest target. You could use the -motioncommand option for your DropSite to find the nearest directory in the tree as you drag the group across.
Just by inspection (so I could easily be totally wrong here ;-), it looks to me that you are not passing a complete path specification to your AddGroupToDir subroutine, as you are only taking the text from the dirtree item, which would just be the leaf directory name, not the whole path. That might account for the difference between the Tk version and your stand-alone test.
Sorry, I'd need to do some homework on that one too!
I hope this is of some help! I'd also like to thank you for posting this as it is an interesting example for me in my ongoing (but low priority) interest in Tk.