Conditions are ANDed. Names come from what people said on calls, so a condition only matches if someone actually told you.
A token wins over the tenant field. The tenant field only works on a server started with the dev override, which must never be on for anything reachable from a network.