Sometimes costumers are fixed on strange ideas 
To limit the WiFi access only to devices in access list it is necessary to bind interfaces or a vlan-id to the reject-rule. Or instead configure MAC address rules for all interfaces/ssids.
Our problem: there are more than one slave-SSIDs for the same VLAN and with “create-dynamic-enabled” on /caps provisioning the interface names will change…
What side effects will we get by changing to “create-enabled” (Why is MikroTik suggesting dynamic interfaces?)