Rules evaluated with a NOT logical operator. To match a policy, a user cannot meet any of the Exclude rules.