Yes, files up the hierarchy to the root, as the app will have broader security etc requirements that all components must abide by (unless they explicitly say otherwise etc).

It's ultimately AI-controlled, so this is more about hints for inclusion, vs being overly prescriptive nor imperative.