Variable override logic hierachy

[TafkaMax]

I have a question regarding the hierachy of the overrides.

groups:
    firewalls:
        models:
            fortios:
                vars: 
                  username: read-only-admin

When I specify specific variables. E.g. username and password for my network device under groups -> models, that should be the option chosen for override options. But for some reason this option does not apply. And the Network device is queryd using username "admin".

Is this intended to be this way? Is there a spec of hierachy of values, which override which?