The normal ZCatalog queries and indexes are extremely limited. For example, I had a need to check for a "Value not in KeywordIndex" expression, which is impossible to do with the normal catalog. AdvancedQuery comes to the rescue, but things aren't too obvious there either. AQ has a In() expression that can be used in building queries, but it does the reverse thing: check something like "IndexedValue not in ListOfValues".

The solution is to check for Eq(), just like the normal KeywordIndex syntax

query = ~ Eq('getFilteredDomains', domain)

In my query, `getFilteredDomains` is the index name and `domain` holds the value I want to exclude from results.

In related news, who knew that unrestrictedSearchResults() can return results unaffected by the roles or permissions that the user has from a normal ZCatalog. I wish I knew this, I had to resort to all sorts of proxy tricks to do this. The only requirement is that this method is called from inside python code, so no python scripts. Guess I need to read the source and documentation next time :-)