NotPrincipals       []StringMatch `json:"notPrincipals,omitempty"`
	SourceIps           []string      `json:"sourceIps,omitempty"`
	NotSourceIps        []string      `json:"notSourceIps,omitempty"`
	DestinationIps      []string      `json:"destinationIps,omitempty"`
	NotDestinationIps   []string      `json:"notDestinationIps,omitempty"`
	DestinationPorts    []uint16      `json:"destinationPorts,omitempty"`

      - presence: {}
      principals:
      - exact: principal
      - prefix: principal-prefix-
      - suffix: -suffix-principal
      - presence: {}
- rules:
  - matches:
    - destinationIps:
      - address: CgoKCg==
        length: 32
      - address: wKgKAA==
        length: 24
      notDestinationIps:
      - address: WgoKCg==
        length: 32
      - address: WqgKAA==
        length: 24

	NotSourceIps        []*Address     `protobuf:"bytes,6,rep,name=not_source_ips,json=notSourceIps,proto3" json:"not_source_ips,omitempty"`
	DestinationIps      []*Address     `protobuf:"bytes,7,rep,name=destination_ips,json=destinationIps,proto3" json:"destination_ips,omitempty"`
	NotDestinationIps   []*Address     `protobuf:"bytes,8,rep,name=not_destination_ips,json=notDestinationIps,proto3" json:"not_destination_ips,omitempty"`

			SourceIps:        whenMatch("source.ip", when, false, stringToIP),
			DestinationPorts: whenMatch("destination.port", when, false, stringToPort),
			DestinationIps:   whenMatch("destination.ip", when, false, stringToIP),

			NotNamespaces:       whenMatch("source.namespace", when, true, stringToMatch),
			NotPrincipals:       whenMatch("source.principal", when, true, stringToMatch),