NOT operation needed for firewall rule

If you want to allow a specific function, e.g. LENGTH, but no other, to be used with a particular column you can create a rule

rule match_length_on_a match function length columns a

for a filter used in whitelist mode. However, that requires you to use the LENGTH function.

What is needed is to be able to specify

rule match_length_on_a match function NOT length columns a

which is used with a filter in blocking mode.

That is, all statements where a appears in any other function context than LENGTH are blocked.