According to Ted Unangst, since doas evaluates rules in a last matched manner, it is prudent to have the "permit root to do everything without a password at the end of the file. Source: https://flak.tedunangst.com/post/doas-mastery
4177ddcfd6