Access Control Platform

What is a access control platform?

Physical keys are a security liability: lost keys, unreturned keys from leavers, and no record of who entered where. Access control replaces keys with managed credentials and rules: an employee accesses their floor during working hours, a cleaner accesses common areas at set times, and a contractor gets temporary access for one day. When someone leaves, revocation is instant, and audit logs answer questions after incidents.

The platform must handle hardware diversity, from door readers and controllers to locks and intercoms, and the operational realities of large buildings: hundreds of doors, thousands of users, shift patterns, and visitor flows. Integration with HR systems for joiners and leavers, and with visitor management for guests, turns access control from a door system into a building security platform.

Core features

Instant revocation and complete audit logs are the security value.

• Door and zone management: Doors, floors, and zones grouped with access rules, schedules, and holiday calendars.
• Credential management: Cards, mobile credentials, PINs, and biometrics, issued, suspended, and revoked centrally.
• Access schedules and rules: Time-based rules, shift patterns, and temporary access windows per user and group.
• Visitor access: Temporary visitor credentials linked to host approval, with expiry and escort rules.
• Real-time monitoring and alerts: Live door status, forced-door and held-open alerts, and lockdown controls.
• Audit logs and reporting: Complete entry logs, access reports, and incident investigations with export options.
• HR and directory integration: Automatic provisioning and deprovisioning from HR and directory systems.
• Mobile and remote management: Administrators manage doors and users remotely, with mobile credentials for users.

How it is built

Start with doors and credentials for one building, then add visitors, integrations, and multi-site control.

1. Hardware and site research: Survey door hardware, controllers, and building layouts, and confirm integration options.
2. Core access MVP: Build door management, credentials, schedules, and audit logs for a single building.
3. Visitors and alerts: Add visitor credentials, real-time alerts, and lockdown controls.
4. HR integration: Add automatic joiner and leaver provisioning from HR systems.
5. Multi-site expansion: Add central management across buildings, with site-level administration.

Technology considerations

Hardware integration is the central challenge: controllers and readers vary, and door commands must be reliable with offline fallback at the door itself. The permission engine must evaluate rules quickly across thousands of users and doors, and audit logs must be tamper-evident. Mobile credentials need secure provisioning that cannot be easily copied or shared.

• Door controller and reader integration with offline door operation.
• Permission engine for users, groups, schedules, and zones.
• Tamper-evident audit logs with reporting and export.
• Mobile credential provisioning with secure enrolment.
• HR and visitor system integrations.

Challenges to plan for

Access platforms fail on hardware complexity, leaver delays, and tailgating.

• Leaver delays: Manual deprovisioning leaves ex-staff with access. Automate revocation from HR events.
• Tailgating: Authorised users hold doors for others. Use anti-passback rules, alerts, and awareness, accepting that technology alone cannot stop it.
• Door offline behaviour: Doors must work during network outages. Ensure controllers cache credentials and log events for later sync.
• Credential sharing: Cards get lent. Prefer mobile or biometric credentials where sharing is a concern, with usage anomaly alerts.

Who uses it and how it pays for itself

Building owners, employers, and facility managers pay per door, per user, or per site, with larger buildings and multi-site portfolios providing the most valuable contracts. Offices value joiner and leaver automation, since manual key management fails at scale, while residential buildings value visitor access and parcel and cleaner management. Schools, hospitals, and warehouses add compliance and safety requirements, such as lockdown controls and audit trails, which justify higher tiers. Hardware installers are a crucial channel, since they specify controllers and readers during fit-outs and refurbishments. The commercial risk is long sales cycles and hardware lock-in, since buildings replace access systems rarely, so the platform must win on integration breadth, reliability, and total cost, and must support phased rollouts across buildings rather than big-bang replacements.

Deploy in one building first, with a full door survey and a phased migration that runs alongside existing keys until every door and user group is proven. Joiner and leaver workflows should be tested with the customer's HR team before go-live, since automated deprovisioning is the feature that justifies the platform to security managers. Audit-log reporting should be demonstrated with a simulated incident investigation, showing how quickly entry history can be produced, because that exercise convinces sceptical building managers faster than any feature list.

Frequently asked questions