Guard Cascade

One guard config, layered: global → app type → user group → device → agent. Each layer overrides the one above per field. Resolve any context below to see exactly what applies — and why.