The number of possible permutations. To give a little more detail, this company owns  a couple of hundred care homes, in about a dozen geographical areas and three countries. A user can be given access to either every care home in a country, every care home in one or more regions, or any number of specific care homes. To add to the fun, sometimes the care homes are re-organised, so they can be assigned to different regions, or merged or indeed other care homes may be purchased from other companies.
Trying to organise the different AD groups to cater for all of that would be a monumental task that I can't believe out Infrastructure people would agree to. And I don't fancy trying to create enough database or application roles to accommodate that either.