One root assignment carries the default posture; overrides narrow it per scope. Selectors are registry-backed references, conjunctive within one assignment; the effective level per request is the strictest match.