These invert the policy scope and are hard to reason about, so should be useful. (NotPrincipal is part of #8 ).