Access Control
Key Takeaways
- Access control regulates who and what enters and exits a site, and the guard enforces the client's written access policy
- Common methods include ID verification, visitor logs with sign-in and sign-out, badges, electronic cards, biometrics, and escort policies
- Sites are typically divided into public, restricted, and secure zones, each with its own entry requirements
- Challenging an unauthorized person must be polite, firm, and policy-based: ask for ID, ask their purpose, and direct them to sign in or leave
- Tailgating and piggybacking are the most common ways unauthorized persons defeat card-reader doors
What Access Control Means
Access control is the practice of regulating who and what enters and exits a site, building, or area. The guard's job is to enforce the client's access policy — not to invent one. If the policy says only badge-holders may enter after 18:00, the guard stops everyone without a badge, full stop.
Methods of Access Control
| Method | How it works | Typical use |
|---|---|---|
| ID verification | Guard checks a government or company photo ID against a list | Lobby desk, visitor processing |
| Visitor log | Visitor signs in and signs out with name, time, host, destination | Any site with non-employee traffic |
| Badges / passes | Colour-coded card worn visibly; expiry date and zones marked | Employees, contractors, temporary visitors |
| Electronic cards / fobs | Card or fob tapped on a reader; access logged by system | Most commercial buildings |
| Biometrics | Fingerprint, iris, or facial scan matched to a database | High-security areas |
| Escort policy | Unauthorized persons escorted by an authorised employee at all times | Data centres, restricted zones |
A best practice is layered access: a visitor shows ID at the lobby, gets a temporary badge, signs the log, and is escorted beyond the public zone. No single method is enough for a secure area.
Access Zones
Most sites are divided into zones with different rules:
- Public zone — lobbies, parking lots, sidewalks. Anyone may enter; the guard observes.
- Restricted zone — office floors, workshops, server rooms. Only authorised employees and badged visitors; sign-in required.
- Secure zone — server closets, cash rooms, executive suites. Badged employees only, often with biometric or escort requirements and an audit log.
A guard must know which zone a person is standing in and what authorisation that zone requires. A visitor badge valid in the public lobby does not authorise entry to a restricted floor.
Challenging Unauthorized Persons
When you encounter someone whose authorisation you cannot verify, challenge them. The challenge must be polite, firm, and grounded in policy — not in suspicion or attitude:
- Greet and ask for ID — "Good evening, may I see your badge, please?"
- Ask their purpose — "Who are you here to see?"
- Verify — check the access list or call the host
- Direct — if authorised, have them sign in and issue a badge; if not, direct them to the sign-in desk or ask them to leave
- Document — record the encounter in the notebook and, if it becomes an incident, in a report
Never accuse, grab, or escalate. If the person refuses and is not committing an offence, observe and report; if they are trespassing or committing an offence, follow post orders on calling police.
Tailgating and Piggybacking
The most common way an unauthorized person defeats a card-reader door is to follow an authorised person through:
- Tailgating — following closely behind an authorised person through a secured door before it closes, without their knowledge or consent
- Piggybacking — an authorised person knowingly holds the door for someone who has not badged in (often out of courtesy)
Both defeat the access control system. Prevention:
- One badge, one person — every individual must badge in individually
- Do not hold secured doors — politely decline and direct the person to use their own badge
- Position yourself to observe the reader so you can see each badge tap
- Challenge anyone who enters without badging — politely ask them to badge in or step back
Courtesy is not a valid reason to bypass access control. A polite refusal — "I'm sorry, I can't hold the door, please badge in" — protects the site and is the policy-compliant response.
Visitor Log: Required Fields
A complete visitor log entry captures more than a name. The minimum fields are:
- Visitor name and signature
- Date and time in and time out
- Company or organisation the visitor represents
- Host employee name (who they are visiting)
- Destination (floor, room, or zone)
- ID type and number checked by the guard
- Badge number issued, if applicable
A sign-out is as important as a sign-in. Visitors who fail to sign out leave the guard unable to confirm whether they have left the site — a serious gap if an incident is later discovered.
After-Hours Access Control
Access control tightens after business hours. Typical after-hours requirements include:
- Reduced entry points — only one or two doors remain unlocked, all traffic funnels past the guard
- Sign-in required for everyone, including employees who normally badge in during the day
- Escort required for visitors and contractors unless post orders say otherwise
- Alarm zones armed — entering an armed zone without disarming triggers an alarm; the guard must coordinate with the alarm user list before allowing entry
- Access logs reviewed at end of shift for anomalies (entries outside business hours, repeated bad-badge attempts)
The after-hours access list is often shorter and more restrictive than the daytime list. A badge that works at 14:00 may not work at 22:00; that is policy, not a malfunction, and the guard should not override it without authorisation.
A visitor has signed in at the lobby and received a temporary badge. They ask to go up to a restricted floor to see an employee. What is the policy-correct response?
An authorised employee swipes their card and then holds the secured door open for a coworker who did not badge in. What is this called, and what should the guard do?
Which sequence best describes a policy-based challenge of an unknown person in a restricted zone?