A link satisfies this exclude-all constraint only if it contains none of the administrative groups specified in the constraint. This is the inverse filter -- it blocks any link carrying even one tagged resource class from being used for the detour, which is the mechanism for steering backup paths away from links known to be unreliable or physically co-located with the primary path. For example, tagging the primary path's conduit-mates with a 'same-duct' resource class and excluding that bit here keeps the detour from ever routing back through the same physical duct that could fail alongside the primary.