An off switch that loses to the most specific rule is a default, not a veto. model-audit scores each route by the literal segments it matched, so /api/** False only sets the baseline. A deeper declaration overrides it. An unmatched path costs you one lookup, nothing else.
Was this useful?