Does a Cloudflare Access Bypass rule expose my origin to everyone, or only matching traffic?

I'm setting up Cloudflare Zero Trust in front of an internal admin tool served through a cloudflared tunnel, and I want most paths to require SSO login while a health‑check endpoint stays reachable without authentication. The Access policy types include Allow, Require, Block, and Bypass, and the documentation describes Bypass as letting matching traffic skip the identity check entirely.

My concern is scope. If I add a Bypass policy for a specific path or IP range on an application, does the rest of the application still fall through to my Allow/Require rules, or does the presence of a Bypass rule change how the default decision is evaluated for non‑matching requests? I'm also unsure whether evaluation order matters when multiple policies are attached to one application, and what happens to requests that match no policy at all.

Assuming a current Zero Trust dashboard configuration with an IdP already enrolled:

• Is policy evaluation first‑match‑wins, and does Bypass short‑circuit the remaining rules?
• What is the default decision for a request matching no policy on a protected application?
• Is there a supported way to confirm, before rollout, that only the intended path is publicly reachable?