Access Control
Key Takeaways
Access control regulates who and what enters and exits a site, and the guard enforces the client's written access policy
Common methods include ID verification, visitor logs with sign-in and sign-out, badges, electronic cards, biometrics, and escort policies
Sites are typically divided into public, restricted, and secure zones, each with its own entry requirements
Challenging an unauthorized person must be polite, firm, and policy-based: ask for ID, ask their purpose, and direct them to sign in or leave
Tailgating and piggybacking are the most common ways unauthorized persons defeat card-reader doors
What Access Control Means
Access control is the practice of regulating who and what enters and exits a site, building, or area. The guard's job is to enforce the client's access policy — not to invent one. If the policy says only badge-holders may enter after 18:00, the guard stops everyone without a badge, full stop.
Methods of Access Control
| Method | How it works | Typical use |
|---|---|---|
| ID verification | Guard checks a government or company photo ID against a list | Lobby desk, visitor processing |
| Visitor log | Visitor signs in and signs out with name, time, host, destination | Any site with non-employee traffic |
| Badges / passes | Colour-coded card worn visibly; expiry date and zones marked | Employees, contractors, temporary visitors |
| Electronic cards / fobs | Card or fob tapped on a reader; access logged by system | Most commercial buildings |
| Biometrics | Fingerprint, iris, or facial scan matched to a database | High-security areas |
| Escort policy | Unauthorized persons escorted by an authorised employee at all times | Data centres, restricted zones |
A best practice is layered access: a visitor shows ID at the lobby, gets a temporary badge, signs the log, and is escorted beyond the public zone. No single method is enough for a secure area.
Access Zones
Most sites are divided into zones with different rules:
- Public zone — lobbies, parking lots, sidewalks. Anyone may enter; the guard observes.
- Restricted zone — office floors, workshops, server rooms. Only authorised employees and badged visitors; sign-in required.
- Secure zone — server closets, cash rooms, executive suites. Badged employees only, often with biometric or escort requirements and an audit log.
A guard must know which zone a person is standing in and what authorisation that zone requires. A visitor badge valid in the public lobby does not authorise entry to a restricted floor.
Challenging Unauthorized Persons
When you encounter someone whose authorisation you cannot verify, challenge them. The challenge must be polite, firm, and grounded in policy — not in suspicion or attitude:
- Greet and ask for ID — "Good evening, may I see your badge, please?"
- Ask their purpose — "Who are you here to see?"
- Verify — check the access list or call the host
- Direct — if authorised, have them sign in and issue a badge; if not, direct them to the sign-in desk or ask them to leave
- Document — record the encounter in the notebook and, if it becomes an incident, in a report
Never accuse, grab, or escalate. If the person refuses and is not committing an offence, observe and report; if they are trespassing or committing an offence, follow post orders on calling police.
Tailgating and Piggybacking
The most common way an unauthorized person defeats a card-reader door is to follow an authorised person through:
- Tailgating — following closely behind an authorised person through a secured door before it closes, without their knowledge or consent
- Piggybacking — an authorised person knowingly holds the door for someone who has not badged in (often out of courtesy)
Both defeat the access control system. Prevention:
- One badge, one person — every individual must badge in individually
- Do not hold secured doors — politely decline and direct the person to use their own badge
- Position yourself to observe the reader so you can see each badge tap
- Challenge anyone who enters without badging — politely ask them to badge in or step back
Courtesy is not a valid reason to bypass access control. A polite refusal — "I'm sorry, I can't hold the door, please badge in" — protects the site and is the policy-compliant response.
Visitor Log: Required Fields
A complete visitor log entry captures more than a name. The minimum fields are:
- Visitor name and signature
- Date and time in and time out
- Company or organisation the visitor represents
- Host employee name (who they are visiting)
- Destination (floor, room, or zone)
- ID type and number checked by the guard
- Badge number issued, if applicable
A sign-out is as important as a sign-in. Visitors who fail to sign out leave the guard unable to confirm whether they have left the site — a serious gap if an incident is later discovered.
After-Hours Access Control
Access control tightens after business hours. Typical after-hours requirements include:
- Reduced entry points — only one or two doors remain unlocked, all traffic funnels past the guard
- Sign-in required for everyone, including employees who normally badge in during the day
- Escort required for visitors and contractors unless post orders say otherwise
- Alarm zones armed — entering an armed zone without disarming triggers an alarm; the guard must coordinate with the alarm user list before allowing entry
- Access logs reviewed at end of shift for anomalies (entries outside business hours, repeated bad-badge attempts)
The after-hours access list is often shorter and more restrictive than the daytime list. A badge that works at 14:00 may not work at 22:00; that is policy, not a malfunction, and the guard should not override it without authorisation.
A visitor has signed in at the lobby and received a temporary badge. They ask to go up to a restricted floor to see an employee. What is the policy-correct response?
Wave them through; the lobby sign-in is enough
Verify the host employee is expecting them, then have them badge or be escorted to the restricted floor per policy
Refuse all visitor access to restricted floors regardless of policy
Give them your master key and let them self-escort
An authorised employee swipes their card and then holds the secured door open for a coworker who did not badge in. What is this called, and what should the guard do?
Tailgating; ignore it because both people work there
Loitering; call the police
A false alarm; reset the access panel
Piggybacking; politely remind both that each person must badge in individually and document it
Which sequence best describes a policy-based challenge of an unknown person in a restricted zone?
Ask their purpose, ask for ID, verify against the access list or host, then direct them to sign in or leave, and document
Grab them, search them, then call the client
Shout at them to leave immediately and call police
Ignore them unless they are carrying something suspicious
Sections you finish are checked off in the contents.