Tailscale's ACLs (attach users to groups, attach objects to groups, cross link the two in policies) does a bit of indirection to reduce that volume.

e.g.: many objects <-> object tag <-> policy <-> user group attachments <-> user