Thanks for the detailed responses @ruffsl 
Thinking about it some more, I don’t think options B and C contradict each other; I think we should implement both.
So if the override is specified, we would use that. Otherwise, we’d prefix match. That would allow a variety of use cases while still being fairly simple. Of course, we need to make sure to log the exact security directory loaded, and document the lookup mechanism appropriately.
I’ll have a PR out soon.