Policies tied to identity
People should consider policy platforms that direct where users can get to once connected to a wireless network. That way if you have an open AP, which you shouldn't, the policy platform uses the AP or switches to put a particular on a specific Vlan. If the user isn't found in an identity store, then they won't be authenticated or authorized. You can use identity-based network security on .1X networks or WEP environments.