A flaw was found in RHACS. When converting Kubernetes Deployments, ACS reads the label openshift.io/encoded-deployment-config and JSON-unmarshals its value to replace deployment identity metadata. A user with permission to create Deployments can set this label to "null", which is valid under Kubernetes label rules but produces empty metadata (no UID, name, or labels; namespace falls back to "default"). Deploy-time policy violations then disappear from the UI, the deployment is not persisted in Central and affected workloads collide in the Sensor store. Container specs are still read from the real object, but ACS loses the identity needed for enforcement and reporting.