If you actually had to implement something like this - which the second line seems to suggest, you have my sympathies!
Yes: it does seem that it was a slight over-statement to say "impossible". If you have unlimited groups per user, allow users to create their own groups, and don't worry too much about giving new access to already-running processes, then many complex things are indeed possible.
Maybe we need a different maxim: "simple things should be simple, complex things shouldn't drive you insane" !