The final rules of the server will be the sum total of all default rules, all external rules JSON filles, and all ad-hoc rules combined and executed in this order:
Ad-hoc rule array in server.json
External rules files in server.json in the order defined
Ad-hoc rule array in config setting server defaults
External rules files in config setting server defaults in the order defined
CommandBox built-in rules
Any module listening to server interceptions can inject their rules wherever they please in the array.