The first matching row supplies the action.
Stop at the first match
Rule 2 is the first matching row, so its action is used.
winner row=2
A later broad row is not the winner
The default row also matches broadly, but it is later than the winning row and is not reached.
default row match=1
The chosen action is allow
The winning row is allow-web, so this toy decision allows the tuple.
winner row=2
Summary
First match means a later broad deny row does not override the earlier matching allow row.
winner row=2