@@ -104,7 +104,9 @@ deny rules only when their connection and request-processing metadata agree;
 conflicting TLS, destination, credential, parser, or enforcement metadata
 rejects the complete generation. Plain L4 endpoints do not contribute
 request-processing metadata, so they may overlap an L7 endpoint when their
-connection metadata agrees.
+connection metadata agrees. When request paths overlap, a path endpoint with a
+higher specificity rank deterministically overrides broader request-processing
+metadata. Equally specific overlapping endpoints must agree.
 
 The `[openshell.gateway] policy_validation_failure_mode` configuration controls
 rejected generations. It defaults to `fail_closed`, which publishes a quarantine
 
@@ -92,6 +92,8 @@ pub fn find_endpoint_ambiguities(policy: &SandboxPolicy) -> Vec<EndpointAmbiguit
             if endpoint_contributes_request_pipeline_metadata(left.endpoint)
                 && endpoint_contributes_request_pipeline_metadata(right.endpoint)
                 && path_patterns_overlap(&left.endpoint.path, &right.endpoint.path)
+                && path_selector_specificity(&left.endpoint.path)
+                    == path_selector_specificity(&right.endpoint.path)
             {
                 conflicts.extend(request_pipeline_conflicts(left.endpoint, right.endpoint));
             }
@@ -347,6 +349,20 @@ fn path_patterns_overlap(left: &str, right: &str) -> bool {
     glob_patterns_overlap(left, right, '/')
 }
 
+/// Match the runtime route-selection rank used by `L7EndpointConfig`.
+///
+/// Overlapping endpoints with different ranks do not compete for request
+/// metadata: the endpoint with the more-specific path wins. Equal-rank
+/// overlaps must agree because iteration order would otherwise decide which
+/// parser, credential handling, or enforcement behavior applies.
+fn path_selector_specificity(path: &str) -> usize {
+    if path.is_empty() {
+        0
+    } else {
+        path.chars().filter(|character| *character != '*').count()
+    }
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum GlobToken {
     Literal(char),
@@ -541,6 +557,19 @@ mod tests {
         assert!(find_endpoint_ambiguities(&policy_with(left, right)).is_empty());
     }
 
+    #[test]
+    fn more_specific_path_may_override_request_pipeline_metadata() {
+        let mut left = endpoint("api.example.com", 443);
+        left.protocol = "rest".to_string();
+        left.enforcement = "enforce".to_string();
+        let mut right = endpoint("api.example.com", 443);
+        right.path = "/graphql".to_string();
+        right.protocol = "graphql".to_string();
+        right.enforcement = "enforce".to_string();
+
+        assert!(find_endpoint_ambiguities(&policy_with(left, right)).is_empty());
+    }
+
     #[test]
     fn exact_wildcard_tls_conflict_is_rejected() {
         let mut left = endpoint("*.example.com", 443);
 
@@ -203,7 +203,7 @@ The following steps outline the hot-reload policy update workflow.
 
 ### Validation failures
 
-OpenShell validates a complete candidate policy before activating any part of it. Endpoints may overlap when their connection and request-processing metadata agree. For example, two `api.example.com:443` REST entries can contribute different allow and deny rules when they use the same TLS, destination, credential, parser, and enforcement settings. A plain L4 endpoint may overlap an L7 endpoint because it authorizes the destination without contributing request-processing metadata. OpenShell rejects the candidate when overlapping exact or wildcard host selectors can both contribute endpoint configuration and disagree on those fields. Path-scoped endpoints may use different protocols only when their path selectors cannot match the same request.
+OpenShell validates a complete candidate policy before activating any part of it. Endpoints may overlap when their connection and request-processing metadata agree. For example, two `api.example.com:443` REST entries can contribute different allow and deny rules when they use the same TLS, destination, credential, parser, and enforcement settings. A plain L4 endpoint may overlap an L7 endpoint because it authorizes the destination without contributing request-processing metadata. A more-specific path endpoint may override request-processing metadata from a broader endpoint, such as a `/graphql` GraphQL endpoint alongside a general REST endpoint for the same host. OpenShell rejects the candidate when overlapping exact or wildcard host selectors can both contribute equally specific endpoint configuration and disagree on those fields.
 
 The gateway's `policy_validation_failure_mode` configuration determines what happens after rejection. Set it under `[openshell.gateway]` in `gateway.toml`. Its default is `fail_closed`: