what happens if a URL is in 2 zone lockdown rules. Are both rules processed and applied to the URL so its cumulative, or does it just apply the IPs on the first rule it processes?
Zone lockdown help drop down actually explains it
Advanced Options:
In a scenario where you have multiple Zone Lockdown rules, which overlap, you can set a priority to ensure one Zone Lockdown rule is honored over another. For example, if you protected https://example.com/admin/ but also had https://example.com/admin/api/ - and the users to API had a different set of IP allowed IP addresses, then this would keep this area protected.
Of course easiest thing to do is test it out and see 
Thanks, it doesnt really answer, it just tells me how to make sure 1 rule is picked instesad of the other (using priority). I want to have both rules apply, so i have no priority set hoping it will process/apply both, but, this is production so i cannot test it (currently i have not put my URL in the second rule in case it breaks things). The Cloudflare documentation isn’t great for lockdown rules. 