There does not appear to be a limit on the number of firewall rules that a user can express in an API call to Nexus. We should probably add one to avoid huge requests or blowing up OPTE itself with a massive number of rules to match.