It gets what we call a "gaming-unsecured" role. We've already worked with TAC and during our troubleshooting moved the allowall so it looks like:
global-sacl
apprf-gaming-insecured-sacl
allowall
This seemed to fix the particular PlayStation that we were working on. Doesn't fix our issue.
We also have a test SSID, it is completely open and never touches Clearpass. Consoles can connect to these just fine. I feel like something's breaking in Clearpass, but can't find it.