Based on https://github.com/cerbos/cerbos/pull/1439, may I know where I can find documentation on the configuration field to set policy expiration? And what happens when it expires? Will cerbos evict the entry from cache and at the next cycle, sync from the policy repo again?

Hey the flag can be found in the full configuration under

cacheDuration

on https://docs.cerbos.dev/cerbos/latest/configuration/index.html#_full_configuration

Cerbos only caches policies that are used. So if you set a cache expiry, there'll be tiny performance hit the next time you try to use the policy after it has been evicted because it needs to be read and re-compiled. The setting is there as an escape hatch. I don't recommend using it unless you absolutely need to.

Aha. I thought the cache duration was specified inside a policy. Gotcha. In that case, under what circumstance should this be used ( what was it designed for)?

It's mainly an escape hatch for us to help debug any other cache issues that might come up.