[fiddlerwoaroof]

This is completely ignoring the use case of “multiple organizations”. E.g. a contractor might need access to an agency’s network and a client’s network on the same device.

[infogulch]

So the client's network adds an ACL to allow the contractor (a member of the agency's network) to access their system?