You mentioned SAM and NPM, so I guess that you are using Orion alert source.
How assignment to groups works (for Orion alert sources):
- The route to group rules are evaluated in the order in which they are defined (=the rule on to top has the highest priority)
- When match is found, the the assignment is done and the evaluation finishes
- when no match is found by any rule, the default action is used (the "By default ..., unless" row is applied)
For email alert sources first the matching rules are evaluated to match emails to email alert sources - in the order in which they are defined (=the first email alert source in the list has the highest priority). After matching to email alert source is found then the route to group rules are applied in the same way as for the Orion alert sources.
If this information doesn't help, then please attach a screenshot containing all the properties from the "Original Orion Alert" tab and a screenshot containing the route to group rules (you can also send me the screenshots in a private message).