ai-gov: document policy limits (#26046)

<!--Delete sections as needed -->

## Description

Documented policy limitations.

## Related issues or tickets

https://docker.slack.com/archives/C097C5LRXFF/p1788526567563859

## Reviews

<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->

- [ ] Technical review
- [ ] Editorial review
- [ ] Product review

Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>

content/manuals/ai/sandboxes/governance/concepts.md

@@ -37,6 +37,24 @@ share the same domain, either `network` or `filesystem`. MCP policies use Cedar
 statements written in the `MCP` namespace instead of the network and filesystem
 rule format.
 
+### Limits
+
+Organization policies have the following limits, which help ensure fair usage
+and resource availability across organizations:
+
+| Limit                     | Value                                               |
+|---------------------------|-----------------------------------------------------|
+| Policies per organization | 100                                                 |
+| Rules per policy          | 250                                                 |
+| Policy size               | 400 KB total, shared across all of a policy's rules |
+
+Typical policies use only a small fraction of the policy size limit. Domain
+and file path values have no separate length limit beyond valid format.
+
+If these limits don't fit your organization's needs,
+[contact Docker Sales](https://www.docker.com/products/ai-governance/#contact-sales)
+to discuss options.
+
 ## Policy scope
 
 Each organization policy applies either across the whole organization or only