How to exclude specific workspaces from Sentinel Policy runs