In enterprise, one example is when active directory groups are put into the token. This makes sense because permissions are often managed by groups (read write

In enterprise, one example is when active directory groups are put into the token. This makes sense because permissions are often managed by groups (read write, read only, user, admin, etc...), so employees can request a specific group to access some business application(s). This causes issues when an employee invariably has a hundred groups, adding multiple kilobytes to the token, more than is permitted by HTTP headers.