Add support for excluding resources in policies

This patch adds the NotResource key that can be used to specify exclusion policies.