Four settings files, one precedence stack, and the handful of keys that break the stack's rules. Where each file reaches, why some keys merge instead of overriding, and how to find out which file is beating yours.

Rules decide whether a tool call happens; the sandbox decides what it can touch once it does. Rule syntax and the wildcard placement that widens a rule further than intended, path anchoring, working directories, and where the OS boundary goes.