Security group guidance

Question

Hello,
I'm having all sorts of troubles getting security groups working within SharePoint. I'm aware of the various timeouts and caching that occur and have changed my WindowsTokenLifeTime to 30 minutes to pick up security group changes faster. However, I have
some areas in SharePoint where even after days, users in security groups with access to a site, library, or document still do not have access and they don't show up in Check Permissions. Also, I have some instances where a user, as a member of a security group
with access to a file, has access one day and then the next day does not. This happens for multiple users in multiple locations and I have no idea what's going on. 
Is there any guidance other than this about using AD security groups in SharePoint? 
http://technet.microsoft.com/en-us/library/cc261972(v=office.15).aspx
This is really messing with my head. 
Our farm is SharePoint 2013 SP1. Some of my security groups have nested security groups, some don't, and both have these issues. 
Thanks,
Aaron

Answer 1

I'm going to have to re-open this in a Reporting forum because this is so confusing.
So our setup is SSRS2012 on SharePoint 2013. We are doing item level permissions, which means we have an AD security group
Reports-All with Read to the Reports folder, then each actual report has unique permissions. We have a report with the
ProjectManagers AD security group on it with Read (plus some other stuff to let them manage subscriptions), and another AD security group
ProjectUsers with just Read access so they can open the reports. The data source used by this report has the AD security group I mentioned before,
Reports-All, with Read.
At a SharePoint level, things appear to work. When a user in ProjectManagers
or ProjectUsers browses to the library, they see only the 3 reports that those two security groups have permission to see (out of a lot more in the library). That means SharePoint is reading those security group memberships correctly
as far as I can tell.
The issue is when a user in ProjectManagers or ProjectUsers
clicks on a report, they get a reporting server based error message, and the ULS logs have an error specific to the user trying to run the report.
Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The permissions granted to user 'MyDomain\MyUser' are insufficient for performing this operation. (Fault Detail is equal to Microsoft.ReportingServices.ServiceContract.RsExceptionInfo)
If I add that specific user with Read permissions to the report and the data source, they are then able to run the report without errors. It seems like some Report Server component is not liking the fact that I'm using security groups. 
Even though I'm going to put this elsewhere I figured I'd expand on my situation here in case it's an obvious solution to someone.