James,
This can be controlled through several different means depending on the granularity:
1) Global Level: Cluster Wide Property io.xmlPartMaxBytes which be default is 2 MB and set in bytes and covers all request XML and non-XML payloads.
Take the Global and narrow down based on service/policy
2) The Listen port on the Advanced tab in the Override maximum message size section for inbound payload
3) Limit message size assertion for both inbound, outbound, context variable payloads for validation of size
4) Routing Assertion such JMS and HTTP can also enforce limits being returned.
Sincerely,
Stephen Hughes