A city segments the staff Enterprise SSID from an open guest network. What architecture hygiene does that separation primarily enforce?

Segmenting the staff Enterprise SSID from an open guest network primarily enforces architecture hygiene: staff 802.1X and guest networks should be separate SSIDs and VLANs with different trust levels so a guest compromise does not become staff LAN access. Segmentation does not force guest devices to complete PEAP-MSCHAPv2 before DHCP. It should not allow one shared PSK to authorize both staff EAP and guest captive-portal users. It should not merge RADIUS accounting so guest MAC addresses inherit staff Active Directory groups. Exam caveat: same AP hardware can host multiple SSIDs, but Layer-2 and Layer-3 isolation must be verified, not assumed from SSID names alone. Operational check: from a guest association in a civic building, attempt reachability to staff subnets and management interfaces, and document firewall or ACL evidence that isolation holds. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.