An IAM policy that blocks specific permissions for certain principals even if a role grants them. It is evaluated before allow policies and is inherited through the resource hierarchy.
On the ACE it is how you restrict an inherited permission: allow policies only add, so to remove, for example, storage.buckets.delete on a specific project you use a deny policy.
IAM deny policy is a concept that can show up on the exam. Check the full guide to see it in context.