The access-control system supports a single operator. You can use the EXCEPT operator to create exceptions to matching names or patterns when you have multiple entries in either serviceList or clientList. For example, the expression:
list1 EXCEPT list2
means that anything that matches list1 is matched, unless it also matches list2.
Here is an example:
ALL: ALL EXCEPT isserver.siroe.com
If this were a Deny filter, it would deny access to all services to all clients except those on the host machine isserver.siroe.com.
EXCEPT clauses can be nested. The expression:
list1 EXCEPT list2 EXCEPT list3
is evaluated as if it were:
list1 EXCEPT (list2 EXCEPT list3)