While the actual code markup is pretty well explained, in Google developers docs, it is unclear where in a web page or on which pages the markup needs to occur and in what relation to the actual reviews that are aggregated.
For example, I see many pages around the web that are getting rich snippets with reviews, however when you visit the page, there are no visible reviews or indication of where those reviews are coming from. (Example Google search: radio connections Los Angeles )
I think this type of implementation may be against Google guidelines, but the guidelines are unclear. Do aggregateRatings need to reference where those ratings originate? Do they need to be on the same page as the individual reviews or ratings?
I'm talking in a strict 'white-hat' way, because it seems that to get the rich snippet in Google, the aggregateRatings do not actually need to reference or be connected anything and are essentially self-contained.
The Schema.org type AggregateRating doesn’t even offer a property to reference the single ratings, or to specify the source.
On top of that, not all aggregate ratings are based on ratings that are available online. Think of ratings collected per phone, paper etc.
Anyway, the guidelines for Google’s Reviews/Ratings Rich Snippets are only documenting in which cases Google Search would consider displaying this rich snippet for your page. If you don’t follow their guidelines (e.g., you don’t provide a property "required" by Google), the worst that happens is that no rich snippet is shown (leaving aside cases of intentional misleading or spamming). Google is just one of many Schema.org consumers, and there are plenty of useful Schema.org uses that don’t necessarily comply with one of Google’s Rich Snippets.
The vocabulary Schema.org does not require any properties.