Why must background be set to false on a Kyverno policy whose rules use request.userInfo, such as the requesting user's name or roles?

Answer: Background scans run without an admission request, so there's no user

Explanation

Background scans check resources already stored in the cluster, outside any admission request, so there's no requesting user, group or role. Kyverno requires background: false for rules that use variables only an admission request provides, and those rules then run only at admission time.