{"id":"rbac-notactions-subtraction-not-deny","text":"`NotActions` in Azure RBAC role definitions subtracts from the `Actions` set — it is not a deny rule; a separate role assignment granting excluded actions will still apply.","truth_value":"IN","source":"entries/2026/03/11/rbac-custom-roles.md","source_url":"","source_hash":"49f4e6e3d4fc5a34","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"rbac-notactions-subtraction-not-deny","truth_value":"IN","reason":"premise"}]}}