Never gets & Separation of Duties
Never gets is the deny effect. Its own words in the builder: "Ploy denies this access and surfaces anyone who has it." It does two jobs at once. It keeps the matched population out, and it names everybody in that population who already holds the access today.
A refusal beats a grant
This is the one precedence law worth memorising: a refusal beats a grant, always. If a Gets policy and a Never gets policy reach the same person for the same target, the person does not get the access.
The same holds on the request side. A Never gets policy over people a Can request policy covers leaves the request door open onto something they could never hold, and the overlaps card says so: "It lets {shared} ask, but this policy means they would never hold it."
You will see the deny explained from both seats in the overlaps card. From the granting policy's seat, the loudest sentence in the product: "It refuses {names}, so they do not get this access." From the deny's own seat: "{n} of its {total} people are refused here. The other {rest} keep the access."
The one way through a deny is an exception, a narrow carve-out linked to that specific deny. An exception punches through the one policy it names and nothing else.
Writing a separation of duties
The access to and permission fields in the Who are what make Never gets more than a block list. They select people by what they already hold, so you can write "nobody who can approve a loan may also raise one" as a single standing statement as shown in the below screenshot.
Ploy refuses one shape of this: a policy that removes the same access it selects people by. It would undo its own population every time it ran. The message names the fix: "This policy removes the same access it selects people by, so it would undo itself every time it ran. Remove something else, or select people by different access." A loop closed by three or more policies together is not caught by this check.
The settings it offers
Never gets carries the same two settings as Gets, and they answer different questions.
Revocation enforcement decides what Ploy does about people who already hold the forbidden access: Suggest only records it and waits for a person to apply the change, Auto-suspend suspends it automatically and reversibly, Auto-revoke removes it. Suggest only is the starting point for every policy.
Manual overrides decide what happens when somebody grants the access by hand anyway: Reverse takes it back off them and shows you what happened, Flag lets the grant stand and shows it to you for review, Log lets it stand and tells nobody. Flag is preselected.
After you activate
The policy drawer's Details tab lists the people who hold access the policy forbids, by name.
If somebody grants the access by hand against the policy, an Overridden tab appears: "Access that someone changed by hand, against this policy. Restore puts it back the way the policy says; exempt keeps the manual change and stops the policy managing that pair." Each row offers Restore access or Exempt from policy. Exempting is permanent, and no automated pass can ever reopen it.
Those kept-by-hand grants are counted separately in your coverage as Overridden, not folded into Unexplained, so "somebody decided this" never hides inside "nobody can explain this".
Good to know
Never gets can target Everything, which is how you write an org-wide refusal. Gets cannot.
An org-wide denial appears on every affected resource's own Policy tab, under Org-wide denials.
Identity requirements, the ", via identities where …" clause, are refused on an Everything target: "Account requirements need specific resources for now".
A deny alongside a Can't request policy is not a conflict. Neither is a deny that only shares a target with a grant but no people; an overlap needs both the same target and at least one shared person.
Acting automatically on more than 50 people needs a confirmation before it saves: "Activating applies this to {N} people today. That's above the confirmation threshold (50)."
Auto-revoke is the strongest setting in the product. On a first deny, Suggest only and a few days of watching the queue is the cheaper way to find out whether your Who is right.