Allow Kibana role to access all indices EXCEPT FOR a specific one

Ack. I've asked so many questions in Kibana lately that I didn't even think about where I should be putting it. Thanks for the pointer! Any way to move it over to the correct category?

        "names": [
          "/~(([.]|ilm-history-|logs-myapp.log-prod).*)/"
        ],

In other words, it's all got to be part of one match pattern for a DENY, multiple patterns don't get merged? But if I'm doing an ALLOW, then any one of multiple index patterns will allow it?