diff --git a/backend/src/ee/routes/v1/access-approval-policy-router.ts b/backend/src/ee/routes/v1/access-approval-policy-router.ts
index 7cab45c6f..aec5eafc5 100644
--- a/backend/src/ee/routes/v1/access-approval-policy-router.ts
+++ b/backend/src/ee/routes/v1/access-approval-policy-router.ts
@@ -27,6 +27,7 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
             z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
+          .max(100, "Cannot have more than 100 approvers")
           .min(1, { message: "At least one approver should be provided" }),
         bypassers: z
           .discriminatedUnion("type", [
@@ -34,6 +35,7 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
             z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
+          .max(100, "Cannot have more than 100 bypassers")
           .optional(),
         approvals: z.number().min(1).default(1),
         enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard),
@@ -154,13 +156,15 @@ export const registerAccessApprovalPolicyRouter = async (server: FastifyZodProvi
             z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
-          .min(1, { message: "At least one approver should be provided" }),
+          .min(1, { message: "At least one approver should be provided" })
+          .max(100, "Cannot have more than 100 approvers"),
         bypassers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
             z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
+          .max(100, "Cannot have more than 100 bypassers")
           .optional(),
         approvals: z.number().min(1).optional(),
         enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard),
diff --git a/backend/src/ee/routes/v1/secret-approval-policy-router.ts b/backend/src/ee/routes/v1/secret-approval-policy-router.ts
index 5bc45636b..46f3e0ee8 100644
--- a/backend/src/ee/routes/v1/secret-approval-policy-router.ts
+++ b/backend/src/ee/routes/v1/secret-approval-policy-router.ts
@@ -33,13 +33,15 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
             z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
-          .min(1, { message: "At least one approver should be provided" }),
+          .min(1, { message: "At least one approver should be provided" })
+          .max(100, "Cannot have more than 100 approvers"),
         bypassers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
             z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
+          .max(100, "Cannot have more than 100 bypassers")
           .optional(),
         approvals: z.number().min(1).default(1),
         enforcementLevel: z.nativeEnum(EnforcementLevel).default(EnforcementLevel.Hard),
@@ -85,13 +87,15 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
             z.object({ type: z.literal(ApproverType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
-          .min(1, { message: "At least one approver should be provided" }),
+          .min(1, { message: "At least one approver should be provided" })
+          .max(100, "Cannot have more than 100 approvers"),
         bypassers: z
           .discriminatedUnion("type", [
             z.object({ type: z.literal(BypasserType.Group), id: z.string() }),
             z.object({ type: z.literal(BypasserType.User), id: z.string().optional(), name: z.string().optional() })
           ])
           .array()
+          .max(100, "Cannot have more than 100 bypassers")
           .optional(),
         approvals: z.number().min(1).default(1),
         secretPath: z
diff --git a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts
index c06a489e9..afecd1220 100644
--- a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts
+++ b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts
@@ -359,6 +359,7 @@ export const accessApprovalRequestServiceFactory = ({
 
     const isApprover = policy.approvers.find((approver) => approver.userId === actorId);
 
+    // If user is (not an approver OR cant self approve) AND can't bypass policy
     if ((!isApprover || (!policy.allowedSelfApprovals && isSelfApproval)) && cannotBypassUnderSoftEnforcement) {
       throw new BadRequestError({
         message: "Failed to review access approval request. Users are not authorized to review their own request."