Policy requires least privilege on AP switch drops across city buildings. Which VLAN-trunk practice best matches that hygiene?

Policy requiring least privilege on AP switch drops across city buildings means designers should not trunk all VLANs to every AP drop; they should limit trunks to VLANs required at that location. Carrying only the needed user, management, and related segments reduces what a compromised AP or malicious device swap can reach on that floor. Convenience trunking of the entire VLAN catalog trades short-term simplicity for long-term blast radius across municipal buildings. Trunking every VLAN including unused labs to every AP for future convenience maximizes exposure if the port is abused. Removing native VLANs and relying on clients to invent tags is not a coherent trunking practice. Disabling spanning tree only on AP trunks to speed convergence risks loops when someone plugs in a bridge or miswires a closet during an event. Exam caveat: controller-based tunneling may reduce which user VLANs need to appear on the AP trunk, but management and tunnel VLANs still deserve least-privilege discipline and documentation. Operational check: inventory VLANs allowed on a sample AP trunk per building floor, remove unused lab and foreign department VLANs, and retest that required SSIDs still forward while a deliberately unauthorized VLAN is no longer present on the drop.