Enable APM on SharePoint Subsite Only

There really isn't an order to iRules. BIG-IP essentially compiles them into byte code and then reorganizes everything for consistency and performance. If there are two iRules applied to a VIP with the same event, then those events are combined into one. It could look like this:

HTTP_REQUEST { 
    ACCESS::disable
    if { [string tolower [HTTP::path]] contains "/private/"} { 
        ACCESS::enable
    }
}

Or just as easily look like this:

HTTP_REQUEST { 
    if { [string tolower [HTTP::path]] contains "/private/"} { 
        ACCESS::enable
    }
    ACCESS::disable
}    

It is, perhaps by fortune, that the commands in these events are executing in the desired order. The priority command allows you to explicitly order events. With a baseline of 500, lower numbers are higher priority. Example:

when HTTP_REQUEST priority 100 {
    ...
}