checks:
  addAllBuiltIn: false
  exclude:
    # These relationships are created by controllers/CRs outside the rendered
    # Deployment set, so static object matching cannot resolve them.
    - dangling-service
    - non-existent-service-account
    # Lab intentionally runs single replicas; topology spread is still declared
    # on application workloads. staging/prod must add replicas and PDBs.
    - no-anti-affinity