How does Gatekeeper complement Kubernetes' built-in admission controllers?

Why this is the answer

Built-in controllers ship fixed behavior; Gatekeeper adds arbitrary, versioned custom policy on top via webhooks and CRDs. It does not disable the built-ins, does not merely duplicate them, and does not reconfigure the compiled-in controllers.