How do multiple SecurityFilterChain beans and request matchers work?

I build a route-to-policy matrix and test representative allowed, unauthenticated, and forbidden requests for every chain, including new routes and management ports. Chain order is part of the security design and deserves a regression test. Error handling, CSRF, CORS, session policy, and authentication mechanisms can differ by chain, so shared configuration is extracted carefully without obscuring those differences. During incident review I record both the selected chain and matched authorization rule without exposing secrets.