In one embodiment, a method includes identifying, responsive to a triggering event, one or more radio frequency (RF) firewall transceivers that neighbor a data wireless access point to which a given wireless client is communicating; configuring one or more of the identified neighboring RF firewall transceivers to detect RF frames transmitted by the wireless client; causing the data wireless access point to transmit one or more wireless messages operative to cause the wireless client to transmit RF frames; collecting RF signal data corresponding to the RF frames transduced by one or more of the identified neighboring RF firewall transceivers; transmitting the collected RF signal data to a location system; receiving from the location system an indication of the location of the wireless client; and applying one or more network access policies based on the indication of the location.