You propose every socket in a visitor-reachable room defaults to a zone a stranger's laptop cannot use — who signs it, and who refuses?

## Why this is a principal question and not a configuration change The change itself is trivial to make and impossible to keep. Any engineer can move a set of ports to a restricted zone in an afternoon. What makes it a standard is that it depends on a fact nobody owns: which physical rooms a stranger can sit in unescorted. That fact lives in the facilities world, changes without a change ticket, and has no representation in the network's records. The proposal is therefore mostly an organisational one — a definition, an owner, an obligation to notify, and a funded way of staying true. ## The three estates and what each controls - **Facilities / workplace services** designate rooms, book them, move walls and refit floors. They can turn a training room into a visitor lounge over a weekend, entirely within their own authority, and nothing about that decision reaches a switch. - **Physical security** decides who is escorted, which doors are controlled, and what is behind the cage door. They set the actual boundary the standard is trying to mirror. - **The network team** owns the switchport and is the only party that can implement anything — and the only one with no visibility of the input the whole standard depends on. The structural problem is not that anyone is unwilling; it is that the map between physical zones and logical zones has three part-owners and no accountable one. That is the thing to ask for first, because without it the standard has no maintenance path and every later argument recurs. ## Who refuses, and whether they are wrong - **Room bookings and the AV owner.** Meeting rooms contain fixed video systems, room panels and phones that need corporate reach. They will refuse a blanket rule, and they are right that a room is not homogeneous — the answer is per-socket, which costs a survey and a record rather than a policy line. - **Operational teams with kit in public places.** A scanner in a loading bay, a display in a lobby, a kiosk in reception. Each is a real business dependency on a socket in exactly the rooms the standard targets. - **The budget holder.** The ask includes re-patching, labelling, a restricted path to run permanently, and staff time for an exception queue that never ends. This is where a proposal dies, and it dies quietly — by being approved in principle and unfunded in practice. - **The team that will be blamed for friction.** Whoever answers "the socket in room 1.14 doesn't work" inherits a queue on day one, and if that queue has no service level, the pressure to widen the exceptions is immediate. ## How to actually win it 1. **Bring a count, not a principle.** "Thirty-one sockets in rooms visitors sit in unescorted currently land in the staff VLAN, in eleven rooms, four of which were re-designated since the last survey." That sentence moves budget; "defence in depth" does not. 2. **Ask for the owner before the money.** A named accountable owner for the physical-to-logical map, with facilities obliged to notify on re-designation, is cheap and is the thing that makes everything else durable. 3. **Make exceptions first-class.** An exception process with an expiry date, a named requester and a review is what keeps the standard alive; a standard with no exception route is routed around silently, which is worse than the exception. 4. **Stage it by evidence.** Highest-exposure rooms first — unescorted, publicly accessible, currently landing in a staff zone — rather than a floor at a time. 5. **Concede the decay in writing.** The map is true on the date it was surveyed. If the recurring re-survey is cut, say plainly what the standard degrades to, so the decision to cut it is a decision somebody made rather than something that happened. ## The alternatives and their prices, honestly stated A default-deny posture at the socket is cheapest to build and most expensive in friction, and that friction is what erodes it. A restricted zone for public rooms is more usable and becomes a permanent thing to run and support. Requiring devices to prove a credential before the port forwards is the strongest and is a multi-year programme with an enrolment estate behind it — proposing it as the answer to a lobby socket is a way of deferring the lobby socket indefinitely. A principal-level answer names all three, says which one the organisation can actually sustain given who is in the room, and does not pretend the strongest is available this year. ## What an interviewer is listening for Ownership before technology; a named refusal with a legitimate reason behind it rather than a strawman; funding for the recurring part, not just the project; and the honesty to state what the control degrades to when the recurring part is cut. The failure mode is a candidate who describes the target state beautifully and cannot say who signs it.