{"id":"rbac-notactions-exclude-not-deny","text":"NotActions excludes operations from the allowed Actions set but is not a deny — it simply subtracts from allowed permissions.","truth_value":"IN","source":"entries/2026/03/10/rbac-custom-roles.md","source_url":"","source_hash":"b1213904ef0695fb","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"rbac-notactions-exclude-not-deny","truth_value":"IN","reason":"premise"}]}}