Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.