I believe we need AND NOT; the users_manage provider has that syntax.