Constant MAX_EXPR_LEN 

pub const MAX_EXPR_LEN: usize = 1024;

Maximum CEL expression length accepted at admission (the cost-budget surrogate; cel 0.13 has no built-in cost API). 1 KiB is far beyond any real identity expression and bounds parse/eval work on adversarial input.