Hostel network access control that survives move-out day

The problem is not granting access. It is ending it.

Granting access is a happy path that everybody remembers, because somebody is standing there asking for it. Ending access has no such prompt. There is no moment where a system asks whether the person who left last month should still be able to connect.

So the honest question for any hostel network is not "how do students get on?" It is "what happens to their access when they go, and who has to remember to do it?"

Roles, not exceptions

A hostel has at least four kinds of user and they need different things: residents, wardens and staff, visitors, and shared equipment that belongs to the building rather than a person. Most networks handle this with a list of manual exceptions, which decays the moment somebody who maintained it moves on.

Treating them as roles instead means a new resident inherits a policy rather than needing one written for them, and a leaver's access ends with their tenancy rather than with somebody's memory.

What identity buys during an intake

• Bulk onboarding, so an intake is a list rather than a queue at a desk.
• One identity per student, carrying across their phone, laptop and anything else they bring.
• Access tied to the stay, so move-out day removes it without a separate task.
• A visible answer when a device appears that belongs to nobody on the list.

That is what EWUS AnyB is for. It also covers the awkward middle case that shared passwords cannot: a student who is legitimately here, on a device the network has never seen before.