Looking at the delpoyment options, if you choose sidecar, are policy updates only changeable with a full application deployment?

No, Cerbos is able to monitor and load new policies from the store without a restart. On a Kubernetes environment, it's probably easier to use a store like

git

,

blob

or any of the database stores because you can update the policies from a single place. If you use a

disk

store, it'll be a bit trickier because you'll have to write to the volume mounted to each sidecar.