And we're not talking only about capacity, but speed as well. In the past, the relative speed between Web portals was difficult for remote users to discern. Users came in on slow dial-up connections. Problems with latency were attributed to the modem connection. Your access control should be able to function without slowing things down.
Scalability is also an issue in terms of setup and management of accounts.
If you have tens of thousands or even millions of users, bulk loading of account data from other systems is crucial. Defining access and establishing roles for large quantities of users needs to be automated, but also the access-control system should enable selective delegation of administrative tasks. Even delegation of administrative tasks to multiple levels could leave some administrators swamped. Self-administration, consistent with business goals and industry norms, is the answer. For example, you might give users the ability to sign up for access, select their own passwords and user IDs, create profiles and select resources to which they wish access.