Is there a limit (theoretical or otherwise) for the number of security groups?

1,522 users / 5,049 groups
We created security groups that were specific to certain functions. Cube security groups, Scenario security groups, Entity security groups, UD1 security groups (type of activity), UD7 security groups (data type) and Role security groups (journal create / approve / post security groups). We did use some account security groups, but that was for system accounts (confirmation rule overrides and ECC ownership accounts).

For the most part it is a flat security setup. There are some areas where we nested groups in groups (ie: view all entities has all the view entity groups in them – same for modify all entities). We also created roles such as Analyst, Data Loader, BU Controller, CFO Controller that also was made up of other security groups.

For workflows we used the entity security groups for about 90% of the time. The other 10% we needed to create new workflow security groups.