As discussed in yesterday's IETF meeting, CAPPORT Architecture states that the CAPPORT web server signals allow/deny rules to Captive Portal Enforcement device. In reality, however, there may be intermediate devices like RADIUS servers or WiFi controllers that are doing that signaling, not the CAPPORT web server (and in the case of walled garden entries, the web portal is never involved). The architecture diagram and related sections of the document should perhaps be updated to show that.
Another option that occurred to me was using LLDP for capport signaling. Do you think there is any utility in pursuing this?