Where should I put local-system-specific rules or configuration options?

Local configurations should go in the site-specific area - typically /etc/mail/spamassassin or /etc/spamassassin. All files in this directory matching *.conf will be processed in lexical order.

Do not put them in /usr/share/spamassassin (where the rules distributed with SpamAssassin are stored) - this directory is cleaned out when new versions of SpamAssassin are installed. Type "man Mail::SpamAssassin::Conf" for details of what you can configure, and how to do it.

If you are an "end user" and do not have update access to /etc/mail/spamassassin, then your configuration parameters should go into your $HOME/.spamassassin/user_prefs file. Assuming your mail host's configuration allows for individual configurations, this file is read and then merged with (and supercedes) site-specific and distribution parameters. (If your host's configuration does not allow for individual configurations, then chances are you do not have a $HOME/.spamassassin directory.)