The proposal on the table in 2006 was to secure switch ports by MAC address. A MAC address is printed on a label on the underside of the device, and anyone who can read it can present it. That is not a control; it is a record of what was plugged in last, dressed as one.
The case made instead was to authenticate the user or the device.
What actually happened
The city did not have that in production until 2021, and it did not arrive in the shape proposed. Rather than 802.1X everywhere, it landed as identity in Cisco ISE, posture and enforcement in ForeScout CounterACT, and certificate-based SSIDs where those were needed.
Both halves of that sentence belong on the record. The position was right and the specific design was not what got built — because fifteen years of platform generations, agency politics and vendor capability sat between the argument and the estate, and an architect who insists on their original drawing through all of that is not being rigorous, they are being attached.
Why fifteen years is the interesting number
The position held across four platform generations, which is a longer horizon than most technical arguments survive. It held because it was an argument about a property — that a control has to authenticate something that cannot simply be copied — rather than about a product, and properties outlive products.
Being early is only useful if you are still there when the organization is ready. That is the real lesson here, and it is an argument for staying somewhere long enough to watch a standard land rather than for being clever in a meeting in 2006.
Outcome
Authentication of the user or device rather than of a label — reached eventually, and not in the form originally proposed.