Just to give an example of the pain that can be caused by NotAction in practice: https://www.reddit.com/r/aws/comments/3recc9/this_iam_policy...
This policy looks reasonable to a casual observer, but actually gives * access to everything in the account. IAM policies are _hard_.