How do you validate a controller when the plant model is uncertain?

I work on controller design where the plant model always has some uncertainty, and reviewers often ask how the design was validated beyond simulation.

I'm curious how others handle this in practice, especially when hardware testing is limited.

What validation approach do you use before claiming a controller is robust?