diff --git a/ci-broker.md b/ci-broker.md
index fc491905..b3f56fcd 100644
--- a/ci-broker.md
+++ b/ci-broker.md
@@ -1122,6 +1122,40 @@ triggers:
 ~~~
 
 
+## Filter predicate `Not`
+
+_Want:_ We can allow an event if the contained filter denies it.
+
+_Why:_ This is for consistency.
+
+~~~scenario
+given a Radicle node, with CI configured with broker.yaml and adapter dummy.sh
+given a Git repository xyzzy in the Radicle node
+
+given file config.yaml from filter-not.yaml
+
+when I run cibtool --db ci-broker.db event add --repo xyzzy --ref main --commit HEAD --kind branch-deleted
+when I run cibtool --db ci-broker.db event add --repo xyzzy --ref oksa --commit HEAD --kind branch-created
+
+when I run ./env.sh cib --config config.yaml queued
+
+when I run cibtool --db ci-broker.db run list --json
+then stdout doesn't contain "main"
+then stdout doesn't contain "oksa"
+~~~
+
+~~~{#filter-not.yaml .file .json}
+db: ci-broker.db
+adapters:
+  default:
+    command: ./adapter.sh
+triggers:
+  - adapter: default
+    filters:
+      - !Not Allow
+~~~
+
+
 # Acceptance criteria for test tooling
 
 The event synthesizer is a helper to feed the CI broker node events in