Your network is designed as a three-tier network model that contains core, distribution, and access switches. QoS is implemented on the network. The access switch in a wiring closet is the only device

The core switch is too far upstream in the three-tier model to serve as the trust boundary; it does not interact directly with end devices and remarking at the core introduces latency and policy complexity.

The trust boundary defines the point in the network where QoS markings are accepted as valid without being overridden. If the access switch lacks the capability to reclassify packets, the network must trust the markings set by the end device itself, placing the trust boundary at the end device. This means the end device bears the responsibility for correct classification, which is a less secure design but necessary when the access layer cannot perform remarking.

The access switch would be the preferred trust boundary in a standard design, but since it cannot reclassify packets in this scenario, it cannot enforce policy and therefore cannot be the trust boundary.

The distribution switch operates above the access layer and does not have direct visibility to end-device traffic classification at ingress, making it an inappropriate trust boundary location.