After login on a hospital-affiliated city clinic WLAN, clinicians and guests must receive different network privileges. Which model best describes that outcome?

After login on a hospital-affiliated city clinic WLAN, clinicians and guests must receive different network privileges, which is best described as RBAC that maps each population to different WLAN roles and permissions. Role-based access control uses identity from authentication to authorize distinct VLAN, ACL, or application outcomes so clinical devices and visitor devices do not share the same effective network rights. That model is central to enterprise WLAN authorization design in healthcare-adjacent civic settings where one SSID may serve multiple trust levels. Identical open access for every successful association regardless of identity abandons differentiation after login and treats every badge the same. Static WEP keys that differ only by building floor are deprecated cryptography and are not identity-based RBAC. Disabling SSID broadcast as the only privilege boundary confuses discovery hygiene with authorization policy. Exam caveat: RBAC only works if RADIUS attributes or equivalent role mapping is consistently configured on both the AAA platform and the WLAN system—mismatched dictionaries commonly produce “everyone lands on guest” failures. Operational check: authenticate a clinician test account and a guest test account to the clinic SSID, confirm different role or VLAN assignment, and verify the guest cannot reach clinical EHR subnets that the clinician role can reach per written policy.