Why do we exclude the hypervisor ID from rules?