The BYOD policy is a permissions document

The contractor works from a personal phone and a personal laptop. The office engineers are on the LAN. Both need staging.

The container's proxy permissions say it in a dozen lines. One group is ip with the office CIDR. One is password for the contractor. The office group gets terminal: true, files: true, display: true. The contractor's group gets terminal: 1 and display: 2: one shell, one desktop, nothing else. Default is deny.

The contractor opens the terminal URL on a phone in a café, answers the HTTP Basic prompt, and is in. The proxy sees the real client IP, so the office rule matches office traffic.

When the contract ends you delete one group. Nothing on their devices needs wiping, because nothing was ever on them.

Device policy stops being about devices and becomes a document about URLs.