ip_policy_excludes is a list of excluded CIDRs passed in when creating the subnet.  It gets turned into a hydrated IPPolicy/IPPolicyCIDR object relationship via https://github.com/rackerlabs/quark/pull/68/files#diff-9a0851e31508a64062c3e85432075de0R160