Checking "EXCLUDE" allows you to exclude a subset of users by selecting Access Definitions and/or providing direct input of specific users, groups and/or certifiers.
In case multiple Actions are to exclude the same users, you can either use (a) corresponding group(s) from the public addressbook in the direct input field, or create so called Access Definitions in the MC Configuration database for further re-use across multiple Actions.
NOTE: When checking EXCLUDE without selecting any Access Definitions and without supplying any direct input, all users who have the role [Admin] in the MC Configuration database will be excluded from the respective Action.
See Also
The Who tab
Specifying target users for an Action (ONLY FOR)
Selecting Access Definitions
Specifying target users for an Action (ONLY FOR - direct input)
Excluding users from an Action (EXCLUDE - direct input)
Under the hood of the Who tab