Due to the way the MatchString function currently works, it is not possible to test for "This but not that".
See documentation for IfRole:
Use:
Checks if the current user is in any of the roles you pass.
You can pass multiple roles (comma separated).
Please note that the test function exits as soon as one of the passed values is found so this works as an OR for multiple values.
So IfRole="editor,manager' will be true if a user is a member of one or both roles.
IfRole="editor,!manager' will not work as "Editor but not Manager" the second value will not be tested.
In a future version it would better to not use commas, but a boolean separator.
Due to the way the MatchString function currently works, it is not possible to test for "This but not that". See documentation for IfRole:
In a future version it would better to not use commas, but a boolean separator.
Like:
and handle the boolean separators correctly