Root Guard blocks a port from ever becoming the root port: if a superior BPDU arrives, the port enters root-inconsistent (blocks traffic) and recovers automatically when the BPDU stops.

• Use: downlinks from your root — root → distribution/access.
• Protects the election, not the topology; not for access ports.

One-liner: Root Guard protects the throne — not the loop prevention.