HAL-335: Workaround using include-aliases=true; more fail-safe RBACGatekeeper