Both Assignment and Rbacl are node types, so we will need to prevent all node actions on them that are permitted to other nodes later in this policy.