Which feature should an engineer select to implement the use of VLAN tagging, QoS, and ACLs to clients based on RADIUS attributes?

Per-WLAN RADIUS source support specifies which RADIUS server interface is used for a given WLAN and does not enable dynamic attribute-based policy assignment.

Client profiling classifies endpoints by device type or OS using DHCP and HTTP fingerprinting but does not apply VLAN, QoS, or ACL policies from RADIUS attributes.

AAA override, when enabled on a WLC WLAN, instructs the controller to accept and apply RADIUS-returned attributes such as Tunnel-Private-Group-ID (VLAN), QoS-Level, and ACL-Name on a per-client basis. This overrides the static WLAN-level configuration, enabling identity-aware network segmentation and policy enforcement without requiring separate SSIDs. It is the specific WLC feature that enables RADIUS attribute-driven dynamic policy assignment.

Captive bypassing allows specific clients to skip the captive portal entirely and is unrelated to RADIUS attribute-based policy assignment.

Identity-based networking is a broader architectural concept; the specific WLC configuration option that applies RADIUS attributes to override WLAN defaults is called AAA override.