Some policies are 50KB or more in size and there is no real limitation of the policy size.
Each policy contains key value pair where keys are predefined terms like "type" or "value" which does not contribute to usability of the policies and just consumes resources.
Each time after policy is executed, data that was parsed is discarded and next time MCU needs to go again through whole policy.
Most of the time policies for one device are similar with minor modification. When new policy is received, whole policy is copied to the memory although 90% of data is similar to the one already stored.
Parsing JSON is not native and requires additional library for most widely used embedded programming languages. Using additional library consumes additional memory.
JSON is written in ASCII string format which is human readable but requires additional memory space compared to binary notation.