In more detail
Rules use User-agent, Disallow and Allow lines, plus a Sitemap line. The file must sit at the root of each host (https://example.com/robots.txt), so every subdomain needs its own. When an Allow and a Disallow rule both match, the most specific (longest) one wins, as standardised in RFC 9309. Well-behaved crawlers obey it; malicious ones simply ignore it.
Why it matters
It controls crawling, not indexing: a blocked URL can still appear in results, so use noindex to keep a page out, and leave that page crawlable so the noindex can be seen. A leftover Disallow: / from a staging site blocks the whole live site. Because the file is public, listing secret paths in it advertises them; never use it to hide sensitive content.
Example
User-agent: *
Disallow: /admin/
Allow: /admin/help/
Sitemap: https://example.com/sitemap.xml
/admin/settings is blocked, while /admin/help/faq may be crawled because the longer rule Allow: /admin/help/ wins. See How SEO Meta Tags Work.