The self-serving rule, which catches most sites
Google does not allow review snippets for a business reviewing itself or its own core offering. A software company marking up a five-star rating of its own software is ineligible, regardless of whether the reviews are genuine.
The markup has to be about a specific item a third party reviewed — a product you sell, a recipe, a book, a course. The distinction is between "customers rated this product" and "we rate our service highly".
This is why so many sites carry aggregateRating that never produces stars. The markup validates, the rich result never appears, and the reason is a policy rather than a syntax error — which is exactly the kind of failure a validator will not tell you about.
Inventing the numbers is worse: fabricated ratings are among the more actively enforced structured-data abuses, and the penalty applies site-wide.