Where should I put local-system-specific rules or configuration options?

Local configurations should go in the site-specific area - typically /etc/mail/spamassassin or /etc/spamassassin. All files in this directory matching *.cf will be processed in lexical order.

Do not put them in /usr/share/spamassassin (where the rules distributed with SpamAssassin are stored) - this directory is cleaned out when new versions of SpamAssassin are installed. Type "man Mail::SpamAssassin::Conf" for details of what you can configure, and how to do it.

If you are an "end user" and do not have update access to /etc/mail/spamassassin, then your configuration parameters should go into your $HOME/.spamassassin/user_prefs file. Assuming your mail host's configuration allows for individual configurations, this file is read and then merged with (and supersedes) site-specific and distribution parameters. (If your host's configuration does not allow for individual configurations, then chances are you do not have a $HOME/.spamassassin directory.)

To clarify the above – if you put the *.cf files in /etc/mail/spamassassin then they are applied to all users on the system.

If you want to make the rules specific to one user, it's different. Putting the *.cf files in the user's $HOME/.spamassassin/ directory won't work; they actually have to be in the $HOME/.spamassassin/user_prefs file.