And we're not only talking about capacity, but speed as well. In the past, the relative speed between web portals was difficult for remote users to discern. Users came in on slow dial-up connections. Problems with latency were attributed to the modem connection. Your access control should be able to function without slowing things down.
Scalability is also an issue in terms of setup and management of accounts.
If you have tens of thousands or even millions of users, bulk loading of account data from other systems is crucial. Defining access and establishing roles for large quantities of users needs to be automated, but also the access control system should enable selective delegation of administrative tasks. Delegation should be role and rights based to enable flexible, scalable granting of administrative rights to entire groups or cross sections of users. Even delegation of administrative tasks to multiple levels could leave some administrators swamped. Self-administration, consistent with business goals and industry norms, is the answer.