...
The NOT
type is one of a very few filter plugin types which can function as a PolicyRule or a Matcher. It takes its behavior from its location. If it is defined within a <
PolicyRequirementRule
>
(either directly or as a child of other logical operations), then it acts as a PolicyRule, otherwise it acts as a Matcher.
Reference
...
XML Elements
Exactly one <Rule>
element must be present (interpreted as either <PolicyRequirementRule>
or <PermitValueRule>
/<DenyValueRule>
based on the context).
PolicyRule Semantics
When used as a PolicyRule, the result is the logical negation of the evaluation of the child rule.
...