Is there a way to define/honour user hierarchy? Example: User1 is manager of User2 thus is able to see the records owned by User2.

There are hierarchy functions: https://docs.cerbos.dev/cerbos/latest/policies/conditions.html#hierarchies Basically, you need to send the hierarchy information in the request and the policy condition (or derived role) can make use of that to determine the access rules.