As far as I understand, best practices recommend that security groups are used with a Windows domain to assign permissions over files and folders. That is, you should create groups in Active Directory, populate them with users, and then assign permissions to folders and files through the groups rather than individual users. I can see the benefits of this approach, BUT:
In my organisation we use a corporate information system for our daily operation. Every project and department are recorded into the system, and the system knows who belongs to each department and project. We are implementing a folder synchronisation mechanism by which the system can apply permissions to shared folders in our file servers to replicate our organisational structure. For example, if we have a "Sales" department with members Alice and Bob, the system will create a shared folder "Sales" and give it permissions for Alice and Bob. This works nicely, and has practically removed the need to manually assign permissions to folders and users.
The issue is that we are not sure whether Active Directory groups still make sense in this scenario. In principle, we assumed that one or more AD groups would be created for each department and project, and permissions assigned to it as usual. For example, there would be groups Dept-Sales-Head and Dept-Sales-Members, each with its own members, for the head and members of the Sales department, and permissions would be assigned through these groups. Our automated system is capable of creating and managing the AD groups. But we are afraid that we will end up with too many groups, as the number of organisational entities in our company grows. I seem to recall that it is not recommended to have over 5000 groups per domain, and it is very likely that we approach this number in a few years, so this approach would not be scalable.
The other option we are considering is to ditch security groups and have the automated system to assign permissions to folders using individual user accounts. This would remove the issue above, but we are concerned that a group-less security approach like this may have undesirable consequences that we cannot anticipate now.
So my question is: Does this group-less approach to filesystem permission assignment make any sense? Do you foresee any undesirable consequences in the long run?