Yeah exactly, if we're being totally cynical there's nothing stopping someone from avoiding DHCP allocation and setting their IP manually to something that would avoid the restriction (obviously depending on other clients using that IP and conflicting - but if it was an IP range for example, it's a way around it). Depends how much we think that untrusted tenant might know about how you've implemented the policy.

This is exactly why I was interested in applying rules to the MAC address rather than an IP. I know MAC addresses can also be changed but nevertheless, there are only a limited number of identifiers available to use.