How to exclude users from policy rules.