When a user attribute is empty (without any value) and the Identity Policy condition is set to "NOT equal" some value of this attribute. The the Identity policy using this attribute is not able to recognize empty value, therefore IP is wrongly assigned or unassigned.
Release : 14.4
Component : IdentityMinder(Identity Manager)
Checking value =/= NULL will always provide false as result.
This is by design.
Use double check:
Attribute =/= expected_value
Attribute =/= *