Access control: people, doors, zones, and permissions

Access control is usually bought as hardware and should be designed as policy. Before a reader is chosen, four questions need answers: who should be able to enter, which doors and areas that covers, at what times, and what happens when a person changes role or leaves. Every one of those is an organisational decision, and none of them is made easier by installing equipment first.

Map people and places

Zones are where most designs succeed or fail. Group doors by what is behind them rather than by where they sit in the building, so permissions can be granted by role instead of door by door. A design with six well-chosen zones stays manageable for years; one with sixty individual doors becomes a spreadsheet nobody maintains, and within a year half the staff have access to everything.

Choose the right credential

Then there is the part that gets skipped: leaving. A credential that is never revoked is a door that is permanently open. Agree who removes access and when, make it part of the process that already happens when someone leaves, and audit it periodically. A quarterly review of who still holds access is the cheapest security improvement most organisations can make.