"if": {
    "not": {
      "anyOf": [
        {
          "field": "tags",
          "containsKey": "CostCentre"
        },
        {
          "field": "tags",
          "containsKey": "Environment"
        }
      ]
    }
  },
  "then": {
    "effect": "deny"
  }
}