Is there a sort of upper bounds on how many policies you can have before cerbos starts to have performance issues?

We have done internal tests with tens of thousands of policies and haven't noticed any significant performance issues. Obviously, there are lots of factors that affect performance other than the number of policies. Some of them are environmental. Therefore we recommend you do some testing on your own infrastructure to understand how Cerbos behaves under load. Generally, it is recommended to have plenty of CPU available. You can also tune the Cerbos cache sizes based on your workload. Because Cerbos is stateless you can easily scale it up or down as needed as well.