Permission Denied for a User that is part of AD
As the comment by Randi Vertongen suggested, more than likely that user belongs to more than one group, one of which has explicit deny permissions on the object in question.

This query will show you which group(s) that user belongs to.  

EXEC xp_logininfo 'DomainName\AD_User', 'all'


You can then look at the output for all of the results (making sure to also check for that specific user) to see if they have any deny permissions.