Commercial Access Control Operational Reference
Access Control Systems: Technology, Architecture & Intelligent Entry
Understand how commercial access control systems operate, how permissions and entry events are managed, what administrators can verify, and what happens when something goes wrong.
The path this reference follows
- Credentialis presented
- Readercaptures it
- Controllerdecides
- Door hardwareoperates
- Event recordis written
- Integrationsvideo & analytics
Introduction
Most people experience access control as a single gesture: tap a card, hear a click, open the door. Behind that second is a chain of separate jobs.
A reader captures data. A controller compares it with rules. A lock changes state. Sensors report what the door actually did. Software writes a record that someone may need months later.
This reference follows that chain link by link, with attention to what facility teams see, verify and do, both when the system works and when it does not. It is written for facility managers, property managers, operations leaders and security staff at businesses across Atlanta, Georgia, Tennessee and South Carolina—and for anyone who wants to understand how the technology behaves, not just what it is called. It does not recommend products or vendors. Where a capability depends on particular hardware, software, licensing or configuration, the text says so.
If you are preparing a project and need help defining requirements, the separate Commercial Access Control Planning Guide covers that work. This page explains the machinery.
Chapter01
The Fundamentals of Physical Access Control
What physical access control is
Physical access control is the practice of deciding who may pass through a controlled opening, at what times and under what conditions—and then enforcing and recording that decision. The opening might be a door, a turnstile, a vehicle gate, an elevator floor or a storage cage.
The word “physical” separates it from logical access control, which governs computer accounts and data. The two increasingly share identity data, but they protect different things.
An electronic access control system does three jobs that a key cannot:
- It decides per person and per moment. A key works for anyone holding it, at any hour. An electronic credential is assigned to a specific person, and the system applies that person’s permissions: only certain openings, only at certain times. The system recognizes the credential, though, not necessarily the person presenting it.
- It can be changed without touching the door. Revoking a lost credential is a database change, not a lock change.
- It keeps a record. Each attempt—successful or not—can be logged with the credential, its assigned holder, the opening, the time and the outcome.
Four distinct questions: identify, authenticate, authorize, enter
Everyday language blurs these together. Keeping them separate explains a great deal about how systems are designed and where they fail.
| Step | The question it answers | Typical mechanism | What can go wrong |
|---|---|---|---|
| Identification | Who is claiming access? | A card number, mobile credential ID, PIN entry or enrolled biometric template | A credential is presented by someone other than its owner |
| Authentication | Is the credential genuine—and, where a personal second factor is used, is the presenter its holder? | Cryptographic exchange with a secure card, a matching PIN, a biometric match, or a combination | A cloned card or shared PIN passes as the real holder |
| Authorization | Is this identity allowed here, now? | Access levels, schedules and door rules evaluated by the controller | Permissions are too broad, out of date or misconfigured |
| Physical entry | Did the opening actually operate, and did one authorized person pass? | Lock release, door sensor, request-to-exit device | The door is propped, forced or held while others follow |
In most deployments, authentication confirms that the credential is genuine, not that the person holding it is its assigned owner. A borrowed, shared or stolen card authenticates exactly like the original until it is reported and revoked. Evidence about the presenter comes only from an added factor tied to the person (a PIN, which can itself be shared, or a biometric match) or from human or video verification. Access logs therefore record which credential was used; who actually used it is an inference.
A system can authenticate perfectly and still authorize the wrong person if permissions are stale. It can authorize correctly and still be defeated physically if the door does not latch. Each step is a separate design problem.
The five building blocks
Every access control system, from a single door to a regional portfolio, works with five elements:
- People — employees, tenants, contractors, visitors, and sometimes vehicles treated as identities.
- Credentials — something a person carries, knows or is, which the system can read.
- Policies — the rules: which groups may use which openings, during which schedules, under which conditions.
- Controlled openings — doors, gates and other points where a decision is enforced in hardware.
- Events — the record of what happened: grants, denials, alarms, state changes and system faults.
The rest of this reference examines how these elements connect. Chapter 2 names the hardware and software involved. Chapter 3 follows a single access event through all of them.
Chapter02
Anatomy of an Access Control System
An access control system is a set of devices, each with one job to do. Knowing which device is responsible for what is the fastest way to understand what you see at a door. It also tells you where to look when something goes wrong and who to call.
Credentials and readers: identifying the request
The credential is what a person carries, knows or is: a card, fob, phone, PIN or enrolled biometric. The reader at the opening captures it and passes it on. Readers come as card readers, keypads, mobile-credential readers, biometric terminals or combination units.
Operationally, the reader is the system’s face. Its lights, tones or display tell the user whether the request was accepted, and they are usually the first thing staff describe when reporting a problem. A reader that shows no response at all points to a different fault than one that shows a red light. In many systems the reader does not make the access decision; it collects the request and reports it.
Controllers: making and enforcing the decision
The controller (also called an access control panel or door controller) usually holds the rules for its doors and makes the grant-or-deny decision. It also watches door sensors and drives the lock and any local alarm.
A single controller may serve one door or many. In some systems the decision is made in a device at the door or inside the lock itself. What matters day to day is knowing which controller serves which doors, where it is mounted and how it is powered. A controller problem usually affects every door it serves, not just one.
Management software: where people administer the system
The access control management platform is where administrators add and remove people, assign credentials, set access levels and schedules, configure doors, and review events. It may run on a local server, as a hosted cloud service, or as a combination.
In many professional systems, the software sends rules to controllers in advance, so it does not approve each swipe in real time. In those designs, doors can keep working if the software becomes unreachable, but administrators lose the ability to make changes and see live events until it returns. Not every system works this way; some depend on a live connection for decisions or for particular features. Chapters 6 and 11 cover what that means in practice.
Electronic locking hardware: securing and releasing the opening
The locking device—an electric strike, electrified lockset, electrified exit device, magnetic lock or other electrically controlled mechanism—is what actually secures or releases the door when the controller signals it.
The lock is where electronic decisions meet the physical door and life-safety requirements. It is also where many day-to-day problems start, from doors that do not latch to locks that release slowly. Chapter 7 covers how these devices behave.
Door position and request-to-exit devices: reporting what the door did
A door position switch (DPS) reports whether the door is open or closed. Without it, the system knows only that it released the lock, not whether the door opened. Even with it, the system knows only that the door opened and closed. It does not know whether a person passed through, or how many. Confirming passage takes other means, such as video, people-counting sensors, turnstiles or vestibules.
A request-to-exit device (REX) tells the controller that someone is leaving from the secure side. It may be a motion sensor, a push button, or a switch built into a lever or exit device. Depending on the design, a REX signal may release the lock, suppress a false “forced door” alarm, or both.
Together, these inputs let the system tell a normal exit from a forced entry, and a closed door from one held open. When they are misaligned or missing, the result is false alarms, or real conditions that nobody is told about.
Power and communications: keeping everything running and connected
Readers, controllers and locks need low-voltage power, usually from dedicated power supplies or from Power over Ethernet (PoE) where the hardware supports it. Backup batteries are common. Their condition and capacity determine how long doors keep behaving normally during an outage.
Communications link readers to controllers, and controllers to the management platform over the facility network or an internet or cellular connection. When a link fails, the effect depends on which link it is and how the system is designed (Chapter 6).
Event records and monitoring: what the system can tell you afterward
Systems can generate an event for significant changes: a grant, a denial, a door forced or held open, a tamper signal, a power fault, a communication loss. Which events exist depends on the installed devices and on configuration. A door with no position switch, for example, cannot report forced or held conditions, and some events can be disabled or filtered. In many systems, events are stored on the controller, forwarded to the management platform, and often displayed in real time to operators. They may also trigger actions—an email alert, a camera bookmark, an output to another system.
The event log is the system’s memory, and it is only as useful as its setup. That depends on accurate clocks, consistent door names that staff recognize, and a retention period suited to how the organization investigates incidents.
At a glance: who does what
| Component | Responsibility at the opening | What staff typically notice when it fails | What it records or reports |
|---|---|---|---|
| Credential | Carries the identity claim | “My card stopped working”; only one person affected | Nothing itself; its use is logged by the system |
| Reader | Captures the credential and gives user feedback | No lights or tones, or every credential rejected at one door | Credential read; tamper or communication fault on supervised readers |
| Controller | Applies rules and drives the door hardware | Several doors misbehave at once | Grants, denials, door conditions, device faults |
| Management software | Administration, monitoring, reporting | Cannot make changes or see live events; doors may still work | Administrative changes and the long-term event history |
| Locking hardware | Secures and releases the door | Door won’t release, won’t relock, or releases intermittently | Lock status only where monitoring hardware is installed |
| DPS and REX | Report door state and legitimate exits | False forced or held alarms, or no alarms at all | Door open, closed, held, forced; exit requests |
| Power and communications | Keep devices running and connected | Outages, devices offline, behavior on battery | Power and communication faults, where monitored |
Chapter05
Access Permissions and System Logic
Credentials identify people. Permissions decide what those people may do. This logic layer is where an access control system expresses an organization’s rules.
Access levels and groups
Most systems do not assign doors to individuals one at a time. Instead, an access level (also called an access group, clearance or role) bundles a set of openings with a schedule. People receive one or more levels.
A mid-size distribution center might use levels such as:
- All Staff — Business Hours: main entrance and break room, weekdays 6:00 a.m.–6:00 p.m.
- Warehouse Floor — All Shifts: dock passage doors and warehouse entries, 24 hours on scheduled workdays.
- IT Room: network room only, any time, for three named people.
- Janitorial Vendor: main entrance and restrooms, weekdays 7:00 p.m.–11:00 p.m.
Role-based levels keep administration manageable. When someone changes roles, an administrator changes their level rather than editing door lists.
Schedules, time zones and holidays
A schedule (in some platforms called a time zone, a term unrelated to geographic time zones) defines when an access level or door behavior applies. Schedules can include day-of-week patterns, multiple intervals per day, and holiday tables that override normal days.
Doors also follow schedules independent of people. A lobby door may unlock automatically during business hours and require a credential otherwise. Some systems offer “first-person-in” logic: the door stays locked on its schedule until an authorized staff member badges in, so it is never left open on a snow day when nobody arrives.
Controllers keep their own clocks. Accurate time synchronization matters because schedules and event timestamps both depend on it.
Temporary credentials and revocation
Temporary access can be handled in several ways: credentials with start and end dates, visitor passes valid for a single day, or access levels that expire automatically. A roofing contractor might receive a credential valid only for the roof-access door, weekdays 7:00 a.m.–5:00 p.m., for the two weeks of the project.
Revocation removes a credential’s ability to open doors. In a networked system, a revocation made in the software is pushed to controllers, often within seconds to minutes, depending on the platform and network. In offline or standalone locks, the change may not take effect until the lock receives an update—a key difference explained in Chapter 6.
Anti-passback
Anti-passback rules stop one credential from being used to admit a second person or vehicle. Systems implement it in two broad ways, and they have different hardware requirements.
Area (zone) anti-passback tracks whether a credential is currently inside or outside a defined area. After a credential enters, it must be recorded leaving before it can enter again. Accurate tracking depends on the system knowing about exits, so exit paths in normal use generally need an exit-recording method, usually an exit reader and sometimes a vehicle detector in a lane. Where some exits go unrecorded (an emergency exit, for instance), in/out status drifts. Sites then compensate with soft mode, scheduled resets or procedures. Area rules are then enforced in one of two modes:
- Hard: a credential out of sequence is denied.
- Soft: the out-of-sequence use is granted but logged as a violation for review.
Timed anti-passback needs no exit reader. It blocks the same credential from being reused at the same reader, or group of readers, for a set number of minutes. It prevents passing a card back through a gate or fence, but it does not track whether the holder is inside.
Scope matters too. Local anti-passback is evaluated within one controller. Global anti-passback spans several controllers or sites and depends on those devices sharing status, through peer communication or a server. If that link is down, global rules may be suspended or reverted to local or soft behavior, depending on the product.
Exit readers for anti-passback are typically used to record exits, not to stop people from leaving. Requiring a credential to exit through a pedestrian door is a form of egress control that is restricted by building and life-safety codes, and is permitted only in specific circumstances. Vehicle lanes, turnstiles and parking exits are more common places for read-out because pedestrian egress is provided separately.
Anti-passback is most common in parking facilities, data centers and secured perimeters. It depends on disciplined use: under hard area rules, someone who leaves without badging, or tailgates out, will be denied on their next legitimate entry. Systems therefore need an administrative reset, and many reset all credentials to a neutral state on a schedule (for example, nightly).
Special door modes and rules
Systems can apply additional rules to specific openings:
- Two-person rule: two different authorized credentials must be presented within a set time.
- Escort required: a visitor credential works only after an authorized escort’s credential.
- Lockdown: an administrator or trigger places a group of doors in a state where normal credentials no longer release them, while maintaining required egress.
- Interlock (mantrap): in a vestibule with two doors, one cannot open until the other is closed.
- Occupancy limits: entry is denied once a count threshold is reached, where readers on both sides make counting possible.
Availability of each mode depends on the platform and the controller. Lockdown and interlock designs also require careful coordination with fire alarm and egress requirements.
Audit records and exception events
The audit trail answers two kinds of questions: who went where and when (transaction events), and who changed what in the system (administrative events). Both matter. An investigation into an after-hours entry may turn on whether someone added a permission the day before.
Exception events are the ones worth watching: access denied (with reason), door forced, door held open, tamper, duress codes where supported, anti-passback violations, and repeated invalid attempts. A useful system lets administrators route exceptions differently by door and time: a held door at a busy lobby at noon is noise; the same event at the server room at 2:00 a.m. is a signal.
Chapter06
How Access Control Systems Communicate
For a facility team, communications matter for three practical reasons. They determine which doors keep working when a link fails, what administrators can still do, and what the event history will show once things reconnect. This chapter explains enough of the architecture to answer those questions accurately.
The links that matter
Most systems depend on four kinds of connection:
- Reader to controller. Carries credential data from the door to the decision point. Older installations often use a simple one-way connection that is unencrypted and unsupervised: if it is cut or tapped, the system may not notice. Modern installations more often use a secure, two-way connection that is encrypted and reports faults. Which one a site has affects both security and how quickly a damaged reader is discovered.
- Controller to management platform. Carries rule updates down and events up, usually over the facility network or an internet or cellular connection.
- Platform to integrations. Links the access system to video, visitor management, HR or directory systems.
- Site to internet. Required for cloud-managed administration and for remote access to hosted services.
Where decisions are made, and why it matters day to day
The most important design question for continuity is which device holds the rules and makes the grant-or-deny decision.
- At the controller. A common commercial design. Rules are downloaded in advance, and the controller decides locally. A lost connection to the platform affects administration and event delivery more than door operation.
- At an edge device at the door. One device handles one or two doors. A failure stays local to those doors, but there are more devices to power and maintain.
- At the lock. Offline electronic locks hold their own credential list and audit trail. They keep working without a network, but changes reach them only when they are next updated.
- At a server or hosted service in real time. Less common for professional door control, though some systems use it for all decisions or for specific credentials, doors or functions. These designs depend most on the connection, so their offline behavior needs particular attention.
Architecture models compared
| Model | Where administration happens | Typically continues if the link drops* | Typically pauses | Operational considerations |
|---|---|---|---|---|
| Standalone | At each lock or keypad | Everything (there is no link) | Nothing, but changes must be made door by door | Limited or local-only audit; slow to revoke many doors |
| On-premises networked | Server on the organization’s network | Door decisions on stored rules | Administration and live events, if the server or network fails | Organization maintains the server, backups, patching and versions; works without internet |
| Cloud-managed | Browser or mobile app through a hosted service | Door decisions, where on-site controllers decide locally | Administration, live events and remote unlocks, if the internet or service is down | Ongoing subscription; internet dependency; data-handling and vendor-dependence questions |
| Hybrid | Combination, such as a local server with a cloud portal | Depends on which component fails | Depends on design | More components to document and support |
* Where the architecture is designed for local decisions. Confirm for the specific system.
No model is universally best. A single-site facility with strict IT policies may prefer on-premises software. A property manager overseeing many small sites may favor cloud management. Either can be secure or insecure, depending on configuration and maintenance.
Offline behavior and management limits
Keeping doors working through a lost connection is a resilience design objective, not a universal capability. Many controller-based systems are designed to meet it by running in an offline or degraded mode. In those designs, typical behavior includes:
- Doors continue to grant and deny using the last rules the controller received, and schedules keep running on the controller’s clock.
- Administrators cannot add or remove people, change schedules, or unlock doors remotely until the link returns.
- Live alarm display stops, so a forced door may not reach an operator in real time.
- A revocation made during the outage does not reach the disconnected controller until it reconnects.
- Features that span controllers—global anti-passback, cross-site lockdown, server-based integrations—may stop or fall back to a local version.
Other designs behave differently. A system that relies on a server or hosted service for some decisions may deny those credentials, admit only cached credentials, or switch to a predefined door mode. Offline locks are unaffected by network loss but receive no changes until they synchronize.
Event synchronization after an outage
In many systems, a controller stores events locally while disconnected and uploads them once the link returns. That has practical consequences:
Figure 6.1
What the event history shows across an outage
- 01Communication lostA communication-loss event marks the start of the window.
- 02Stored locallyWhere designed to, the controller keeps deciding and stores events. Live alarms, remote unlocks and changes pause.
- 03Connection restoredA communication-restored event closes the window.
- 04Events uploadedStored events arrive late, placed by their recorded time. If storage filled, some may be missing.
- 05After-action reviewReview the window, confirm uploaded events, and reapply any changes made during the outage.
- Records arrive late. Reports run during an outage are incomplete, and alerts for events that happened offline may arrive after the fact, or not at all.
- Storage is finite. Products differ in how many events they hold and in what they discard when storage fills, whether the oldest or the newest events.
- Timestamps matter more. Uploaded events are placed by their recorded time, so controller clock accuracy determines whether the timeline is right.
- Gaps should be visible. Communication-loss and communication-restored events mark the window. Reviewing that window afterward confirms whether anything happened that nobody saw live.
Planning for continuity
A few operational steps turn offline behavior from a surprise into a plan:
- Document what each door does when its controller, the server, the network or the internet is unavailable, and test it.
- Map dependencies. Know which doors rely on which controller, network switch and power supply, so a failure can be scoped quickly.
- Prepare for urgent changes during an outage. If someone must be locked out while a controller is unreachable, the team needs a fallback. That could be restoring the connection, retrieving the credential, or staffing or securing the affected doors.
- Watch communication alerts. A controller that drops offline overnight should be noticed before the morning.
- Coordinate with IT. Firewall rules, network segments, switch replacements and internet changes can silently disconnect security devices. Security devices are usually placed on a separate network segment with tightly limited access, so network changes should include them in testing.
- Use backup paths where available. Some systems support cellular or secondary connections for management traffic; availability and cost vary.
Chapter07
Door Hardware and Physical Operation
The controller decides. The door hardware carries out the decision. This is the point where access control intersects with mechanical engineering, building codes and life safety, and where many real-world problems originate.
Figure 7.1
Anatomy of an electrified opening (simplified)
- Reader — captures the credential on the approach (unsecured) side and gives the user feedback.
- Electric strike or electrified lock — secures or releases the opening when the controller signals it.
- Door position switch — reports open or closed; the basis for held and forced alarms.
- Request-to-exit device — signals a legitimate exit; may shunt the alarm, release the lock, or both.
- Power transfer — carries power into the door for electrified locksets and exit devices.
- Lock power supply — regulated power, often with battery backup and, where required, a fire alarm interface.
- Controller — applies the rules and drives the lock; often mounted remotely.
Electric strikes
An electric strike replaces the fixed strike plate in the door frame. When released, a hinged keeper lets the latch pass, so the door opens without retracting the latch. The lockset on the door remains purely mechanical.
Strikes are common on retrofits because the frame is modified rather than the door. They must match the lockset type, latch projection and frame construction. Fire-rated openings carry added restrictions. Hardware on a fire door generally must be listed for that use, and fire doors are typically required to latch positively during a fire, which commonly means a fail-secure strike. The fire-door standard, the product listing and the authority having jurisdiction decide what is acceptable on a given opening.
Electrified locksets and exit devices
An electrified lockset (mortise or cylindrical) contains a solenoid or motor that locks or unlocks the outside lever. An electrified exit device (a panic bar with electric latch retraction or electric dogging) performs the same role on doors that require panic hardware.
Because power runs into the door itself, these usually require a power transfer hinge, an electrical transfer device or a door loop to carry wires from frame to door. On most egress doors, the hardware is arranged so the inside lever or panic bar releases the door mechanically, whatever the power state. Whether a particular opening actually provides compliant egress depends on the hardware’s function and configuration and on the applicable code.
Magnetic locks
A magnetic lock (maglock) holds the door closed with an electromagnet on the frame and a steel armature plate on the door. It has no moving latch parts, which makes it durable and simple to install on some openings.
Maglocks are inherently fail-safe: they release when power is removed. Because a maglock holds the door against egress whenever it is energized, codes treat it differently from latching hardware. Depending on the code provision used, a permitted installation may need conditions such as an egress-side sensor, a manual release device near the door, release on fire alarm or sprinkler activation, and release on loss of power. Some occupancies and openings do not permit them. The adopted code edition, the occupancy, the specific provision used and the AHJ decide what applies.
Fail-safe and fail-secure
These terms describe what the outside (secure) side of a door does when the lock loses power:
- Fail-safe: the lock unlocks without power. Maglocks are always fail-safe. Some stairwell doors are fail-safe, or are unlocked by the fire alarm, where codes require re-entry; other methods of providing re-entry also exist.
- Fail-secure: the lock stays locked without power. Many perimeter doors and fire-rated openings use fail-secure hardware.
A common misunderstanding is that fail-secure means people are trapped. With most latching hardware, free egress from the inside is provided mechanically by the lever or panic hardware, whatever the power state, so the fail mode describes the secure side. The exception is hardware that locks the egress side itself, such as magnetic locks or delayed-egress and controlled-egress arrangements, where codes set specific release conditions. For latching hardware, the fail mode determines who can enter, not whether people can leave.
Fail mode is chosen opening by opening, and the choice has to satisfy both the security need and the applicable code. The table below shows common patterns, not requirements.
| Device type | Available fail modes | Inside egress (typical) | Common uses | Notes |
|---|---|---|---|---|
| Electric strike | Either; field-selectable on many models | Mechanical, through the lockset, where its function provides free egress | Retrofit doors, offices, interior suites | Fire-rated openings need hardware listed for that use; positive latching usually means fail-secure |
| Electrified lockset | Either, by model | Mechanical, through the inside lever, where the function provides it | Offices, suites, interior doors | Needs power transfer into the door |
| Electrified exit device | Either, by model | Mechanical, through the panic bar | Assembly spaces, corridors, required egress doors | Fire exit hardware generally may not be held retracted (dogged) except under specific listed, code-permitted conditions |
| Magnetic lock | Fail-safe only | Depends on release devices; no mechanical egress through the lock itself | Glass doors and some interior or special applications | Permitted only under specific code conditions, and not in all occupancies |
Monitoring and egress devices
The door position switch (Chapter 2) confirms the door’s physical state. Some locksets add latch or lock status monitoring, confirming that the bolt is actually thrown—a stronger indication than door position alone.
Request-to-exit devices serve two separate functions that are often confused. Alarm shunting tells the controller an exit is legitimate so it does not log a forced door. Lock release actually unlocks the door. Whether a REX does one or both depends on the hardware and the code requirements for that opening. Where a maglock is installed, release devices such as an egress-side sensor or push button may be required parts of the egress path, depending on the code provision applied.
Power arrangements
Locks draw power from a dedicated, regulated supply sized for their current. Supplies commonly include battery backup and may include a fire alarm interface that removes power from designated fail-safe locks when the fire alarm activates, where the design or code calls for it. Strikes and locks may be 12 or 24 volts DC; mismatched voltage or long wire runs with excessive voltage drop are common causes of erratic operation.
Access control systems should also leave clear documentation of which locks are fail-safe or fail-secure, which are tied to fire alarm release, and how long backup batteries are expected to last.
Codes and life safety
Electrified door hardware is governed by adopted building, fire, life safety and accessibility codes, along with product listings and the manufacturer’s installation instructions. Relevant model documents in the United States include the International Building Code, the International Fire Code, NFPA 101 Life Safety Code, NFPA 80 for fire doors, NFPA 72 for fire alarm interfaces, and the ADA Standards for Accessible Design. Which editions apply, and how, depends on the jurisdiction and the occupancy.
This chapter describes typical behavior, not requirements for a specific door, and nothing in it should be read as a statement that a particular configuration complies with code. Every electrified opening should be designed and reviewed by qualified professionals and approved, where required, by the local authority having jurisdiction (AHJ).
Operating notes for facility teams
Day to day, door hardware is where security and convenience meet. A few habits keep it working as designed:
- Know each opening’s fail mode and which doors release on fire alarm, so outage and alarm behavior is not a surprise.
- Watch the door, not just the reader. A door that does not close and latch fully is unsecured, whatever the event log says.
- Treat repeated forced or held alarms as maintenance signals. They usually point to closers, alignment or sensors rather than intrusions, but they should be checked.
- Do not prop, tape or wedge electrified doors, and do not disconnect egress devices or sensors to stop nuisance alarms.
- Route changes to electrified hardware through qualified technicians, and through the AHJ where required, especially on fire-rated and egress doors.
Next · Chapter 08Beyond the Door: Gates, Visitors, Campuses and Multiple Sites
Chapter08
Beyond the Door: Gates, Visitors, Campuses and Multiple Sites
The logic of an access event stays the same whether the opening is an office door or a truck gate. What changes is the physical equipment, the identity being verified, the environment, and the way permissions are organized.
Visitor entry
Visitors have no permanent credential, so the system needs another way to identify and authorize them. Three patterns are common:
- Intercom-mediated entry. An audio or video intercom at the entrance connects the visitor to staff, who verify identity and trigger a remote release. The access control system logs the release as an operator action rather than a credential grant.
- Visitor management. A visitor is pre-registered or checked in at a desk or kiosk and receives a temporary credential—a printed QR code, a day badge or a mobile pass—with limited doors and an automatic expiration.
- Escorted access. The visitor’s credential, if issued, works only alongside an escort’s credential.
Technically, the key distinction is who makes the decision. With an intercom, a person decides in real time. With a visitor credential, the decision is delegated to rules set at check-in.
Commercial vehicle gates
A vehicle gate replaces the electric lock with a gate operator: a motor that slides, swings or lifts a barrier. The access control system provides the authorization signal, but the operator controls the motion and its safety features.
Gate environments add requirements that doors do not have:
- Reader placement suited to a driver’s window, often on a pedestal or gooseneck, sometimes with a second reader at truck-cab height.
- Long-range identification using vehicle tags, long-range readers or license plate recognition (Chapter 10).
- Vehicle detection with ground loops or other sensors to know when a vehicle is present, when it has cleared, and to keep the gate from closing on it.
- Entrapment protection for people, typically photo-eyes and edge sensors required under the gate operator’s safety standard (UL 325 in the United States) and the gate construction standard (ASTM F2200).
- Weather and power considerations, since equipment is outdoors and operators draw significant power.
A gate grant only requests motion; the operator’s safety logic can override it. Exit is usually automatic through a vehicle detector rather than a credential, unless anti-passback or exit tracking is required.
Parking facilities
Parking adds counting and sequencing to vehicle access. Barrier-arm entries and exits commonly use anti-passback so one credential cannot admit two vehicles. Occupancy counts can track available spaces by level or by tenant allocation. Where parking supports paid or validated use, the access control system may integrate with a separate revenue or parking management system. In such cases, each system’s role in authorization should be clearly defined.
Multi-building campuses
A campus typically shares one cardholder database and access-level structure across many buildings, with controllers in each building connected over a campus network. The design questions are about scale and segmentation: how access levels are named so they remain understandable across dozens of buildings, how network outages between buildings affect each one (where controllers decide locally, doors generally keep working), and whether a campus-wide lockdown can be triggered and how quickly it reaches every controller.
Multi-tenant properties
In an office building or industrial park with several tenants, a single system often serves two kinds of administrators. The property manager controls shared spaces—lobbies, elevators, parking and amenity rooms. Each tenant may control their own suite doors and people.
Systems handle this through partitioning: tenant administrators see and manage only their own cardholders and doors, while shared-area permissions are managed by the landlord. Elevator control is a frequent integration point, limiting a credential to the floors its tenant occupies. The technical challenge is keeping tenant data separate while letting one credential work at both shared and tenant doors.
Multiple business locations
An organization with branches, stores or depots in several cities needs central visibility and consistent policy, and usually needs each site to keep operating when its internet link fails. In architectures built for this, controllers at each site make local decisions, and a central platform—on-premises or cloud—handles administration and reporting. Confirm which functions continue at a site that loses its connection.
Key differences from a single campus include internet-based communications rather than a private network, site-level administrators with limited rights, standardized door and access-level naming so reports are comparable, and planning for how quickly central changes (like revoking a departed employee) reach every site.
Chapter09
Access Control and Video Intelligence
Access control records what credential was used at which door and when. Video records what actually happened. Integrating the two connects identity data with visual evidence, but the two systems have different jobs and should not be confused.
How events reach video
Integration between an access control platform and a video management system (VMS) is usually built in one of these ways:
- Software integration: the two platforms exchange events and commands through a supported plug-in, API or software development kit. Access events appear in the VMS, often linked to the camera associated with that door.
- Unified platform: one software platform manages both access control and video natively.
- Hardware I/O: a controller output wired to a recorder or camera input signals an alarm condition. This is simple and dependable but carries little information—the video system knows that something happened, not who.
Every integration depends on supported versions and licensing on both sides. An integration that works with one software release may require updating after the next.
Verification and investigation
The most common benefit is event-linked video. When a door event occurs, the system bookmarks or displays video from the associated camera. An investigator searching for “all denied access events at the warehouse rear door last week” can review each with its video clip instead of scrubbing hours of footage.
Video also answers the questions access logs cannot:
- Was the person using the credential its assigned holder?
- Did more than one person pass on a single grant?
- What propped the door open?
- Did a forced-door alarm reflect an actual break-in or a faulty sensor?
Accurate time synchronization between systems is essential. A few seconds’ offset can link an event to the wrong portion of video.
A typical investigation follows a consistent path:
- Start from the access event: filter by door, time window and outcome.
- Open the linked video for each relevant event, allowing for any clock offset.
- Confirm what the records alone cannot: who presented the credential, and how many people passed.
- Check the administrative audit trail if a permission or schedule change may be involved.
- Preserve the records and clips according to the organization’s retention and evidence procedures.
Alarms and response
Integrated systems can route access alarms—forced door, held door, tamper, repeated denials—to operators with live and recorded video. Rules can be conditional: a held-door event at the lobby during business hours might be logged silently, while the same event at a pharmacy storage room after hours triggers an alert with a video pop-up.
Where a remote monitoring center is involved, video verification can help an operator distinguish a genuine event from a false alarm before dispatching a response. Monitoring arrangements and dispatch requirements vary by provider and local ordinance.
Monitoring is not authorization
In a conventional integration, video watches the access decision; it does not make it. The controller grants or denies based on the credential and its rules. The camera records the result.
That changes only when video analytics are deliberately configured as an input to authorization—for example, a license plate read that triggers a gate, or a facial match used as a credential. That is a different architecture with different risks, covered in Chapter 10. Treating ordinary surveillance as if it were an authorization layer leads to false assumptions about what the system will prevent.
Integration limits
Integration capability depends on details that should be verified rather than assumed:
- Which events and commands the integration actually supports (some pass events one way only).
- Whether remote door commands from the VMS are permitted, and who can use them.
- How each system behaves if the integration link is down; events should still be recorded natively on each side.
- Licensing per door, per camera or per server.
- Update coordination, since a software update on either side can break a working integration.
- Cybersecurity: every integration opens a communication path that must be authenticated and limited.
Chapter10
AI and Intelligent Access Control
In access control, “AI” usually means machine-learning video analytics: software models trained to detect and classify objects, read text such as license plates, or compare faces. These analytics can now feed physical access workflows. Used carefully, they reduce friction and help people notice what matters. Used carelessly, they create new ways for the wrong person to get in.
This chapter follows these capabilities through real entry workflows. It covers how a match becomes an authorization, what happens on a false or missed match, how exceptions are handled, and what privacy, accessibility and fallback look like in daily operation. It also separates established practice from what is still emerging.
Detection, recognition and authorization are different jobs
Three terms are often blurred:
- Detection finds that something is present: a vehicle is in the lane, a person is at the door.
- Recognition identifies which specific thing it is: plate ABC-1234, this face matches enrolled person #418.
- Authorization decides whether that identity may enter here, now. In a sound design, authorization stays with the access control system’s rules, not with the camera.
Analytics are good at the first, increasingly capable at the second, and should hand the third to a rules engine that applies the same discipline as any other credential.
License plate recognition (LPR)
License plate recognition (also called automatic number plate recognition, or ANPR) uses a camera and software to read vehicle plates. It is among the most established forms of analytics-assisted access.
How an LPR gate workflow typically operates:
- A vehicle enters a detection zone, triggered by the video analytic or by a ground loop.
- A camera optimized for plates—often with infrared illumination and a fast shutter—captures images.
- The recognition engine (on the camera, a local server or the VMS) locates the plate and converts it to text, often with a confidence score and, in some systems, the issuing state.
- The plate string is compared against an authorized list. That list may live in the LPR software, or the plate may be passed to the access control system and treated as a credential.
- If the plate is authorized for that gate and schedule, a supported integration sends a release command to the access controller or gate operator interface.
- The gate operator opens, subject to its own safety logic, and both systems log the event with the plate image.
Design points that matter:
- A plate identifies a vehicle, not a driver. A borrowed or stolen car carries authorized plates. For higher-security gates, LPR is often paired with a second factor: a driver’s credential, an intercom verification, or a tag in the windshield.
- Reads are probabilistic. Dirty, bent, obstructed or unusual plates, specialty designs, glare and steep angles all reduce accuracy. Characters such as O/0 and B/8 can be confused. Systems need a defined fallback path for vehicles that fail to read (see “Fallback and alternative entry” below).
- Plates can be imitated. A printed copy of an authorized plate could fool a camera that reads only text. Some systems add checks such as vehicle make, color or a second credential; whether those checks are available depends on the product.
- Data retention. LPR systems capture every passing plate, not only authorized ones. Organizations should decide how long reads are kept, who can search them, and whether sharing with others is permitted. Some states regulate LPR data use, particularly by public agencies.
LPR in daily operation. Most of the work at an LPR gate happens in the exceptions. Typical situations look like this:
| Situation | What typically happens | What the facility team does |
|---|---|---|
| Authorized plate, clean read | Gate opens; event logged with the plate image | Nothing, beyond periodic spot checks of read quality |
| Plate not read (dirty, damaged, temporary tag, glare) | No grant; the driver waits | Driver uses the fallback path; recurring misses at one lane are reviewed for camera angle, lighting or cleaning |
| Authorized plate, unexpected driver (borrowed or stolen vehicle) | Gate opens if the plate alone authorizes | Higher-risk gates pair the plate with a driver credential or intercom check |
| Plate of someone whose access ended | Gate opens if the plate is still on any authorized list | Make sure offboarding removes the plate wherever the list lives (access platform, LPR software or both) |
| Misread that matches a different authorized plate | Wrong vehicle admitted | Review the stored image and confidence; adjust thresholds; keep second factors at sensitive gates |
| Second vehicle follows through | Tailgating vehicle enters on one grant | Review gate close timing and vehicle detection; use anti-passback where exits are recorded |
| Camera, analytics or integration offline | Recognition unavailable | Fallback path takes over; outage is logged and reported for repair |
Facial recognition
Face detection finds a face in an image. It powers features like counting people or flagging that someone is at a door. It does not identify anyone.
Facial recognition compares a detected face with enrolled templates to determine identity. In access control, a facial-recognition reader or analytics engine can act as a credential: the person approaches, the system matches their face to an enrolled record, and that identity is passed to the access control rules for an authorization decision.
Facial recognition at doors is commercially available today, most commonly in purpose-built facial-recognition readers mounted at the opening rather than in general surveillance cameras. Dedicated readers control lighting, distance and angle, and many include liveness detection—techniques such as depth sensing or infrared imaging intended to reject photos, screens and masks. Liveness capability and its effectiveness vary by device.
Design points that matter:
- Enrollment is a security event. The system is only as trustworthy as the process that links a face to a verified person.
- 1:1 versus 1:N. Verifying a face against the person’s card (1:1) is more reliable than searching the whole enrolled population (1:N), especially as the population grows.
- Thresholds are trade-offs. A stricter match threshold reduces false accepts but increases false rejects, and vice versa.
- Performance varies. Independent testing (for example, NIST’s face recognition technology evaluations) shows large accuracy differences between algorithms, and some algorithms show performance differences across demographic groups.
- An alternative entry method is necessary. People who decline enrollment, cannot be matched reliably, cannot use the reader comfortably, or are visitors need another way in that does not single them out or delay them unreasonably.
Facial recognition in daily operation.
| Situation | What typically happens | What the facility team does |
|---|---|---|
| Enrolled person, good match | Door releases; event logged, sometimes with an image | Periodic review of enrollment quality and match logs |
| Enrolled person not matched (lighting, angle, new glasses, injury) | Access denied or a retry prompt | Person uses the alternative credential; repeated misses may mean re-enrollment or a reader adjustment |
| Wrong person matched (false accept) | Unauthorized entry that looks authorized in the log | Treated as a security event: review images, thresholds and enrollment; consider a second factor at that opening |
| Person declines enrollment or cannot be enrolled reliably | No facial credential | Issue an equivalent alternative credential without penalty or unreasonable delay |
| Visitor or new employee not yet enrolled | No match | Visitor process or temporary credential |
| Employee leaves | Template and access must both end | Revoke access and delete the template under the organization’s retention policy |
| Reader or recognition service offline | Recognition unavailable | Alternative credential or fallback procedure; outage logged and reported |
AI-assisted event analysis
The more common use of AI in access control does not make access decisions at all. It helps people interpret events. Examples include:
- Tailgating and piggybacking detection: counting people passing through a door after a single grant and raising an alert when the count exceeds one.
- Classification of alarms: distinguishing a person from an animal, vehicle or moving shadow to reduce false alarms.
- Event correlation: linking a denied credential, a forced door and video of a person loitering into one incident rather than three separate alerts.
- Searchable video: finding clips by attributes such as “person in a red jacket near the dock door after 10 p.m.”
- Pattern alerts: flagging unusual activity such as a credential used at an atypical hour or location. Such alerts depend on good baseline data and generate false positives that must be reviewed.
In all these cases, AI supports human verification. Its outputs are prompts to look, not conclusions.
Integration architecture
Figure 10.1
How a plate or face becomes an entry: the recommended pattern
- 01Camera or facial readerCaptures an image suited to the task.
- 02RecognitionOutputs an identity claim and a confidence score.
- 03Authorization rulesIn the access control platform: active status, schedule and revocation apply.
- 04ControllerMakes or enforces the decision.
- 05Gate operator or lockMoves or releases; safety devices and egress stay independent.
Exceptions
- No read or no match: the fallback path takes over.
- False match: image review, threshold adjustment, second factor where risk warrants.
- Camera, recognition or integration offline: the fallback path takes over; the outage is logged and reported.
Fallback pathCard or mobile credential reader, keypad, staffed or remote intercom, or visitor process, chosen to match the opening’s risk.
Event logRecords the match, the decision and the physical outcome.
| Component | Role in an intelligent-entry workflow | What to verify |
|---|---|---|
| Camera or facial reader | Captures images suited to the task (plate, face) | Placement, lighting, resolution, angle, environmental rating |
| Analytics / recognition engine | Detects and recognizes; outputs an identity and confidence score | Where it runs (device, server, cloud); tested accuracy; liveness or anti-spoofing |
| VMS or recognition service | Manages video, stores evidence, may host analytics and lists | Supported integration with the access platform; licensing |
| Access control platform | Applies authorization rules—the same levels, schedules and revocation as other credentials | Whether plates or faces are treated as credentials or as external triggers |
| Controller | Makes or enforces the decision; drives outputs | Behavior when the analytics or network is unavailable |
| Gate operator or lock | Moves the barrier or releases the door | Safety devices and egress remain independent of analytics |
| Event log | Records the recognition, the decision and the physical outcome | Image retention, audit, access to records |
The recommended pattern keeps authorization inside the access control system. The analytics engine reports “plate ABC-1234, 97% confidence” or “face matches cardholder #418.” The access control rules then decide whether that cardholder is active, permitted at this opening and within schedule. That keeps one place where revocation, schedules and audits apply, regardless of credential type.
Alternative implementations. Products also support other arrangements, and some sites use them:
- Recognition-side authorization: the LPR or recognition software keeps its own authorized list and schedule and triggers a relay, gate operator or controller input directly.
- VMS-side rules: the video management system evaluates the match and sends an unlock or open command through an integration.
- Reader-as-credential: a facial-recognition reader matches locally and outputs a credential number to the controller, which then applies normal rules. This is close to the recommended pattern.
Any of these can work. Where authorization lives outside the access control platform, though, the site takes on extra work: keeping lists synchronized, making sure revocations and expirations reach every list, applying schedules consistently, and keeping audit records that show who was authorized and why.
Whichever implementation is used, appropriate controls typically include current authorization rules and revocation for every recognition-based identity; minimum confidence thresholds; a second factor or human verification where the opening’s risk warrants it; logging of the match, the decision and the physical outcome; and review of exceptions.
Accuracy, security, privacy and limits
- False matches and missed matches. Every recognition system produces both. The consequence of a false accept at a server room is very different from a false reject at a parking gate. Thresholds and fallback procedures should reflect that.
- Lighting and environment. Backlight, low sun, rain, fog, snow, headlights, dirty lenses and seasonal foliage all affect performance. Equipment that works at noon in May may struggle at 6 p.m. in December.
- Spoofing. Printed photos, replayed video, masks and imitation plates are real attack methods. Countermeasures exist but differ widely.
- Cybersecurity. Cameras, analytics servers and integrations are networked devices. Compromising one could allow false recognition events to be injected. Integrations should be authenticated, encrypted and segmented.
- Privacy, consent and biometric data. Facial templates are biometric data. Some states regulate the collection, notice, consent, retention and destruction of biometric identifiers, and some impose significant penalties for violations; requirements also arise from consumer-privacy laws, employment law and contracts. Obligations depend on where the system operates and whose data it collects, so legal review is advisable before deployment.
- Data handling. Decide where templates and images are stored, whether they are encrypted, who can access them, how long they are kept, and how they are deleted when someone leaves.
- Alternative entry. Analytics-based entry points generally need an entry method that does not depend on the camera or recognition engine, chosen to match the opening’s risk (see below).
Recognition alone should not automatically grant access. A match is an identity claim. It should be evaluated against current authorization rules, with safeguards appropriate to the opening: a second factor where risk is high, human verification where confidence is low, and monitoring of exceptions.
Fallback and alternative entry
A fallback is a designed part of the opening, and the right one depends on the opening’s risk and use. A low-risk parking gate might fall back to a card reader or a staffed intercom. A high-security door may need a fallback with comparable assurance, such as card plus PIN, so the alternative does not become the weakest way in. At every risk level, applicable accessibility, privacy and operational requirements still apply, and the fallback should account for four kinds of need.
- System failures. Cameras, illuminators, analytics servers, networks, integrations and power can each fail. The fallback should not depend on the failed component; a card reader wired to the same failed switch is not a fallback. Decide in advance what a gate or door does when recognition is unavailable, who can authorize manual entry, and how those entries are logged.
- Privacy. Where people may decline biometric enrollment, by law or by policy, the alternative should give them comparable access without penalty or excessive delay, and should not collect more personal data than the primary method.
- Accessibility. Some people cannot comfortably use a facial reader’s height or angle, or are not reliably matched because of facial differences, medical devices or coverings worn for religious or medical reasons. Fallback readers, keypads and intercoms need accessible mounting and operation, and applicable accessibility standards should be reviewed for each opening.
- Operational needs. Rental and loaner vehicles, temporary or missing plates, new employees not yet enrolled, visitors, deliveries and fleet vehicle swaps all need a path. That path may be a card or mobile credential reader, a keypad, a staffed or remote intercom, or a visitor process. Consider peak-hour queues, staffed hours for intercom answering, and how fallback use is audited so it does not become an unmonitored bypass.
Fallback paths should be tested on a schedule, just like the primary method.
Established capabilities and emerging ones
| Status | Capability |
|---|---|
| Commercially available from multiple sources (performance varies by product) | LPR for gates and parking with list-based authorization; dedicated facial-recognition readers at doors, often as 1:1 or alongside cards; AI-based person and vehicle classification to reduce false alarms; event-linked video and attribute search; analytics-based tailgating alerts |
| Available but varies widely by product and setting | Liveness detection quality; LPR with vehicle make, model and color verification; frictionless 1:N facial entry at high-traffic doors; behavior or pattern anomaly alerts |
| Emerging or not yet broadly proven | Fully automated access decisions from general surveillance cameras without a dedicated reader; multi-modal identity that fuses face, gait and device signals; natural-language investigation assistants for security operators; predictive risk scoring of individuals |
“Available” here means offered by some products, not supported by all. Specific capability, performance and integration support must be confirmed for the hardware and software involved.
The emerging category raises the largest accuracy, fairness and privacy questions. It is useful to watch, but not a basis for current security design.
Chapter11
What Happens When Something Fails?
Every access control system will eventually lose power, lose a network link, or have a device fault. What matters is whether the facility team knows what the doors will do, what it can safely check, and when to call for help. The patterns below are typical; actual behavior depends on the specific hardware, configuration and site design, and should be documented and tested for each site.
Failures at a glance
| Situation | Expected door behavior (typical) | What staff can safely check | Escalate when |
|---|---|---|---|
| Building power loss | Normal operation on battery for a limited time; then each lock reverts to its fail mode | Which doors are on backup; whether the outage is site-wide | Batteries run low, doors behave unexpectedly, or any egress door does not release |
| Network outage | Where controllers decide locally, doors keep working on stored rules; administration and live alarms stop | Whether other network services are down; communication-loss alerts | Outage lasts beyond a short period, or an urgent revocation is needed |
| Server or cloud unreachable | Similar to a network outage in locally deciding systems; others may deny some credentials | Service status notices; site internet connection | Doors deny valid users, or the outage continues |
| Controller failure | Every door on that controller stops making decisions; physical state follows lock fail modes | Which doors are affected (usually a group) | Immediately, since it affects several openings |
| Reader not responding | Credential entry fails at that one opening | Reader lights and tones; obvious damage or moisture | Damage, repeated failure, or a door without another entrance |
| One person denied | Door works for others | Denial reason in the event log; credential status and schedule | The record looks correct but denials continue |
| Door won’t latch or relock, or false forced/held alarms | Door may be left insecure, or alarms fire falsely | Obstructions, door closing fully, visible misalignment | Always for adjustment or repair; never solve it by propping or disabling devices |
Power loss
When building power fails, battery backup in controller and lock power supplies keeps the system running for a period set by battery capacity, condition and load. Once batteries are exhausted, each lock reverts to its fail mode: fail-safe locks release, and fail-secure locks typically stay locked from the outside. Inside egress depends on the hardware and the code requirements for that opening; on latching hardware it is normally mechanical (Chapter 7).
Many controllers keep their database and configuration in non-volatile memory and resume normal operation when power returns, but retention behavior should be confirmed for the installed hardware. Clocks may need to be resynchronized. Readers and network switches need power too: a controller on battery cannot read a card if the network switch powering the reader has gone dark.
Network, server or cloud interruptions
In systems designed for local decisions, doors generally keep granting and denying with stored rules while administration, remote unlocks and live alarms stop. Events are typically stored on the controller within its capacity and uploaded later (Chapter 6). Where decisions or credential validation depend on a server or hosted service, doors may deny some or all credentials or switch to a predefined mode. Integrations that run at the server level—video linking, HR synchronization, visitor management—pause until the connection returns.
The most important operational gap: a revocation made during the outage does not reach disconnected controllers. If someone must be locked out urgently, the team needs a fallback until the connection is restored, such as retrieving the credential or staffing or securing the affected doors.
Controller and reader faults
If a controller fails, the doors it manages stop making decisions. Fail-safe doors may unlock, and fail-secure doors may stay locked to credential holders. Required egress should be arranged so it does not depend on the controller. Recovery means replacing the device and restoring its configuration, usually by download from the management platform; current backups make this much faster.
A failed reader affects only its own opening. A reader on a supervised connection reports the fault; one on an unsupervised connection may simply go silent until someone notices. Sites typically keep a mechanical key override and a written procedure for who may use it.
Credential errors
Many “system failures” are credential problems:
- A card format the reader is not set up to read.
- An expired, suspended or unassigned credential.
- A mobile credential that is not provisioned, or a phone with Bluetooth or NFC turned off.
- A biometric false reject caused by injury, dirt, lighting or an outdated enrollment.
- An anti-passback violation after someone left without badging.
The denial reason in the event log usually points to which one. Most are resolved by the system administrator.
Door hardware problems
Mechanical problems are among the most common access control complaints, and they often look like electronic faults. A strike will not release because the door is pushed against it. A lock will not relatch because the closer is out of adjustment. A misaligned door position switch triggers false held or forced alarms. A weak power supply causes intermittent operation. Many of these are fixed by adjusting the door, not by changing the system.
Troubleshooting boundaries
Facility staff can do a great deal without opening any equipment:
- Note the door name, exact time and what the reader showed.
- Check the event log for the outcome and denial reason.
- Confirm the credential’s status, access level and schedule.
- Look for obstructions, and check that the door closes and latches fully.
- Check whether the problem affects one person, one door or a group of doors.
Some work belongs to qualified technicians and, where applicable, the authority having jurisdiction:
- Opening controller or power-supply enclosures, or changing wiring.
- Adjusting or replacing electrified locking hardware.
- Changing a door’s fail mode, egress devices or fire alarm interface.
- Any work on fire-rated doors or doors in a required egress path.
Disabling a lock, bypassing a sensor or propping a door to “fix” a problem can create a security gap or a life-safety problem. Report it instead.
Escalation
Route problems by type:
- System administrator: credential, permission and schedule issues.
- Service provider or integrator: device faults, controller or reader failures, hardware adjustment.
- IT: network, internet and server problems affecting security devices.
- Facilities or locksmith: door closers, hinges and mechanical hardware, coordinated with the integrator where electrified hardware is involved.
- Fire alarm contractor and AHJ: anything affecting fire alarm release or egress.
An egress door that does not release when it should is a life-safety issue to escalate immediately, not a routine ticket. A useful service request includes the door name, the time, what the reader showed, the related event log entries, and any recent changes to the door, network or permissions.
Continuity planning
Resilience comes from design decisions and from procedures people know:
- Local decision-making as a design objective, where the architecture supports it, so doors can keep working without the server or cloud. Confirm it in the specific system and test it rather than assuming it.
- Backup power sized for the expected outage and tested periodically.
- Supervised communications, so failed devices raise alerts instead of failing silently.
- Documented fail modes for every electrified opening.
- Mechanical overrides with controlled key management.
- Written fallback procedures: how to secure the building, admit people, keep a manual entry log, and communicate with staff while the system is down.
- After-action review: once service returns, review the outage window in the event history, confirm uploaded events, and reapply any changes made during the outage.
Life-safety functions—free egress, fire alarm release of designated locks, and stairwell re-entry where required—are generally designed so they do not depend on the access control software or network. They are matters of hardware, wiring and code requirements, determined and verified for each opening by qualified professionals and the AHJ.
Next · Chapter 12Managing an Access Control System Over Time
Chapter12
Managing an Access Control System Over Time
An access control system is installed once and administered every day after that. Most real-world weaknesses come from operations, not technology: permissions that drift, credentials nobody revoked, software left unpatched, and logs no one reviews.
Credential administration
Good administration keeps the cardholder database accurate:
- Tie issuance and revocation to an authoritative source. HR onboarding and offboarding, tenant lease changes and contractor start and end dates should all trigger credential actions. Some platforms can synchronize with HR or directory systems automatically; others rely on manual steps.
- Handle lost credentials quickly. Disable on report, then reissue.
- Avoid shared and generic credentials. A “Maintenance” card used by six people produces an audit trail that identifies no one.
- Manage inventory. Track unassigned card stock, visitor badges and mobile credential licenses.
Policy changes and access reviews
Access levels tend to accumulate. People change roles and keep old permissions; temporary access becomes permanent. Periodic access reviews—in which department leads confirm who should have access to their areas—keep permissions aligned with need. Many organizations review sensitive areas quarterly and general access annually; the right interval depends on risk and turnover.
Changes to schedules, door modes and access levels should be documented, so an auditor can see why a door unlocks at 6:00 a.m. and who approved it.
Software and firmware updates
Management software, controllers, readers, locks and integrations all receive updates for features, bug fixes and security vulnerabilities. Cloud-managed platforms update their hosted software centrally, but on-site firmware may still require scheduled updates. On-premises systems also require server operating system and database patching.
Updates should be planned: check compatibility with integrations, back up configuration, schedule a maintenance window, and test critical doors afterward.
Cybersecurity maintenance
Access control devices are network devices and should be maintained like them:
- Change default passwords; use unique, strong administrator credentials and multi-factor authentication for software logins where supported.
- Limit administrator rights by role, and remove accounts for people who no longer need them.
- Keep devices on segmented networks with only necessary connections allowed.
- Encrypt communications between readers, controllers and software where supported.
- Monitor for vulnerability notices affecting installed components.
- Review administrative audit logs for unexpected changes.
Federal resources such as CISA’s guidance on securing connected devices, and established frameworks such as NIST’s, offer useful general principles.
Event retention
How long to keep event records is a policy decision, influenced by investigation needs, industry obligations, contracts, storage capacity and privacy considerations. Controllers hold limited events locally; the management platform keeps the long-term record. Cloud platforms may set default retention periods or charge for extended retention. Video linked to access events usually follows separate, often shorter, retention.
Whatever the period, it should be defined, applied consistently and supported by exports when records are needed for an investigation.
Hardware support and system lifecycle
Components age at different rates. Batteries need periodic replacement. Door hardware wears with traffic. Readers and controllers eventually reach end of support, when manufacturers stop providing firmware and security updates. Credential technology changes too, as organizations migrate from proximity cards to secure or mobile credentials.
Lifecycle management means tracking installed components, their firmware versions and support status, and planning gradual replacement rather than reacting to failures. Many organizations migrate in phases—often by using multi-technology readers that read both old and new credentials during the transition.
Next · Chapter 13Emerging Technologies and Future Directions
Chapter13
Emerging Technologies and Future Directions
Access control changes gradually, because installed doors, wiring and credentials last for years. The developments below are visible in the market today. Each is described by what is available now, what is developing, and what remains uncertain. “Available” means offered by some products, not all; support for any capability must be confirmed for the specific hardware, software and version involved.
Mobile identity and digital wallets
Now
Mobile credentials are offered by many access control platforms. Some platform and phone combinations also support storing an employee or building credential in the phone’s digital wallet for tap-to-enter without opening an app. Wallet support depends on the access platform, the reader hardware and the phone’s operating system.
Developing
Broader reader compatibility, credentials that work across several buildings or landlords, and, in some jurisdictions, the use of mobile driver’s licenses or other digital identity documents during visitor check-in. Acceptance of these documents is still limited and varies by state and by the verifying system.
Uncertain
How quickly physical cards decline. Mixed populations of cards and phones are likely to remain normal for a long time.
Interoperability and open standards
Now
Open communication standards between readers and controllers, and published integration interfaces between access, video and identity systems, are available in many current products. Some controller hardware is designed to run software from more than one platform provider, though compatibility depends on the specific hardware and software versions.
Developing
Wider adoption of secure reader protocols, standardized ways to provision mobile and wallet credentials, and APIs that let HR, visitor and building systems exchange identity data.
Uncertain
“Open” means different things across products. Interoperability claims should be verified for the specific versions involved.
In practice: confirm that an integration is supported for the installed versions before relying on it, and retest integrations after software updates on either side.
Intelligent analytics
Now
Object classification, LPR, tailgating alerts and attribute-based video search are established (Chapter 10).
Developing
Multi-sensor correlation that links access events, video and other building data into single incidents; natural-language search and summarization tools for operators, offered in some products but not yet well characterized by independent testing; more processing on cameras and edge devices instead of servers.
Uncertain
How reliable automated incident summaries will be, and how regulations on AI and biometrics will shape deployment.
Advanced authentication
Now
Multi-factor authentication at doors, liveness detection in biometric readers, and phone-based credentials protected by device biometrics.
Developing
Stronger cryptographic credential formats, identity verification during remote enrollment, and risk-adaptive policies that require an additional factor only when conditions warrant it. Availability varies, and independent performance data is limited.
Uncertain
Whether continuous or passive authentication methods will prove accurate and acceptable enough for routine commercial use.
Evolving system architectures
Now
Cloud-managed, edge and hybrid architectures are all established options (Chapter 6). PoE-powered door hardware and wireless locks reduce wiring on some openings.
Developing
More intelligence at the door, tighter convergence of physical and IT identity management, and shared platforms for access, video and intrusion.
Uncertain
No single architecture is likely to replace the others. Resilience, data governance and cost will continue to favor different models for different organizations.
Chapter14
Technical Questions and Answers
Does the reader decide who gets in?
Often not. In many commercial systems, the reader captures and passes credential data, and the controller makes the decision using rules stored locally. Some all-in-one readers, edge devices and offline locks include their own decision logic.
Why does an access log sometimes show “granted” when the door never opened?
“Granted” records the logical decision. The person may have walked away, or a mechanical problem may have prevented the door from releasing. A door position switch, and latch monitoring where available, show what the door did. Whether anyone passed through requires video or other sensors.
Can one card read work for two different systems, such as access control and time clocks?
Sometimes. The same credential can be read by different systems if they support the same card technology and format, and the credential is configured for both. Secure credentials may need keys or applications provisioned for each use.
What is a card format, and why does it matter?
A card format defines how the bits on a credential are organized into fields such as facility code and card number. Readers and controllers must be configured for the formats in use. Mismatched formats are a common reason a new card fails at an existing reader.
What is the difference between a facility code and a card number?
On many legacy formats, the facility code identifies a batch or site, and the card number identifies the individual credential. Combined, they form the credential identifier. Because facility codes are short, duplicate numbers can occur across organizations, which is one reason secure, unique credential schemes are preferred.
How quickly does a permission change reach the door?
In a connected system, often within seconds to minutes after the change is saved, depending on the platform, controller and network. Offline locks receive changes only when they next synchronize. During a network outage, changes wait until the connection is restored.
Does a cloud-managed system stop working if the internet goes down?
Not necessarily. Many cloud-managed systems use on-site controllers or edge devices that keep making decisions with stored rules, while remote administration, live monitoring and cloud-dependent features pause until the connection returns. Other systems depend on the connection for some decisions or credential types. Confirm and test the specific system’s offline behavior.
What causes “door forced” alarms when nobody forced the door?
Common causes include a misaligned door position switch, a door that bounces open after closing, a REX device that does not register an exit, or a lock that releases slowly. Most are resolved by adjusting hardware or timing.
Can video analytics count how many people enter on one credential?
Some analytics can detect tailgating by counting people passing a door after a grant, and some dedicated sensors do the same. Accuracy depends on camera placement, lighting, crowding and the product. Results should be treated as alerts for review rather than definitive counts.
Is a biometric template the same as a photo or fingerprint image?
Generally not. A template is a mathematical representation of selected features. Many systems do not store the original image, but some do, and some can store images for enrollment or audit. How templates are stored, encrypted and deleted is a system-specific detail with privacy implications.
Can an access control system run elevators?
Yes, where it is integrated with elevator controls. A reader in the cab or at a destination-dispatch kiosk can limit which floors a credential may select. This requires coordination with the elevator equipment and its service provider, and must preserve emergency and fire service operation.
What is a duress code?
Some keypads and systems support a duress PIN that grants access normally while silently signaling an alarm, for use when someone is forced to open a door. Support and response procedures vary.