I can see some safety in this, but where to get the plugin name from? We're loading *.yaml, so I only see:

a) Use the filename; e.g. foreman_discovery.yaml merges into SETTINGS[:foreman_discovery]
b) Set it on the first line of the file, so you have:

    :plugin: discovery
    :discovery:
      :foo: bar
      :baz: quux

Which do you prefer?

In either case, we can't really protect against users changing the value of what's being merged (e.g they could just create a file called puppet.yaml if they wanted to override puppet settings) so is it worth it?