The single most important step to take as of Sakai 2.1 is probably to enable user directory and security service caching. The legacy design tends to make many redundant small queries rather than a few pivotal top level queries. Make sure you have lines like this in your sakai.properties file:

# minutes to cache each user access in the UserDirectoryService - set to 0 to disable caching.
cacheMinutes@org.sakaiproject.service.legacy.user.UserDirectoryService=10
cacheCleanerMinutes@org.sakaiproject.service.legacy.user.UserDirectoryService=10

cacheMinutes@org.sakaiproject.service.legacy.security.SecurityService=5

Regarding scalability of the legacy authz design, see SAK-2660 - "Improve central management of role / permission mappings".

Regarding scalability of Resources in particular, see SAK-3894.