Access to only some lights

So the onboarding has its detractors but as a one-off operation I am pretty ok with it, I’m a geek and can wait.

Now we have lodgers, and I would just LOVE to be able to give my lodgers pretty toys to play with. Why not a version of the app which is pre-configured and will only see his bulbs. (He shares our wifi.)

Not only that but if we change lodgers I want revocation and ability to issue a new key.

How could this be done?A proxy or port mapper perhaps? Have one ssid per lodger and clever forwarding between lodgers networks and the main network. You still have the onboarding problem since the phone remembers the lights it onboarded I think.

Ideas?

If you’re okay with the “honor system,” then locations might be enough. If you want real security, then you probably need a separate SSID.