7.1 Design Constraints & Incorporating Risk Analysis

Design Constraints and Incorporating Risk Analysis

Domain 2 Task 1 is the hinge between a Domain 1 report and a buildable physical security design. Independent OpenExamPrep teaching for published PSP Domain 2 Task 1 knowledge is that the designer does not open a product catalog and “pick security.” The designer takes risk-analysis results—named residual pairings, treatment choices, and the limits the site already lives inside—and converts them into shall statements a drawing, a specification, and a budget can actually satisfy.

Exam focus: Name the constraint family. Let residual risk drive the function you specify. A Sensitive Compartmented Information Facility (SCIF) envelope is not a retail stockroom.

What a design constraint is

A design constraint is a limit the solution must live inside. It is not a preference and not a vendor’s favorite kit. If you ignore it, the “perfect” measure will not be permitted, will not be funded, will not physically fit, or will be bypassed on the first busy Monday. Domain 1 already produced residual-risk language. Domain 2 asks whether that language can survive contact with regulations, money, materials, the systems already in the walls, heritage fabric, owner standards, and the existing cable plant.

Constraints are not excuses to do nothing. They are the box in which an honest design still has to reduce the pairing. A constraint that says “we have only four spare pairs to the dock” does not authorize an unlatched door. It authorizes a measure those four pairs can actually support, plus a documented decision if the pairing still needs a pathway upgrade that is not in this package.

Write constraints in the same notebook as residual risk. A schematic that shows thirty-two new cameras and a footnote that “pathways by others” with no funded others is not a design. It is a wish that will die in value engineering.

Constraint families you will see on items

Regulations and adopted codes

The authority having jurisdiction (AHJ) enforces the building, fire, electrical, and accessibility editions the occupancy actually adopted—not the newest PDF on a laptop. Independent study for published PSP tasks still treats IBC/IFC, NFPA 101, and ADA families as lookup work (Chapter 2), not as slogans. Delayed-egress hardware, electromagnetic locks on required egress, camera placement in some occupancies, and opening force on accessible doors are regulatory constraints. You cannot specify a lock that traps occupants in a fire because residual theft is high. Life safety remains a floor, the same floor Chapter 6 refused to accept in a footnote.

Local amendments matter. A city that forbids certain delayed-egress listings, or a campus that sits in a historic overlay with extra review, is a constraint even when a national model code looks friendlier. Confirm occupancy classification and the adopted edition before you name hardware. Invented section numbers are a liability.

Budget

Budget is capital and operating cost. Chapter 6 already taught total cost of ownership: purchase, install, monitoring, maintenance, power, licensing, and replacement. A design that spends the entire capital line on cameras and leaves zero for a watched or alarmed path has not escaped the budget constraint; it has hidden a detect failure inside a pretty elevation. Budget also includes the owner’s refusal to fund a pathway upgrade. Write that refusal as a constraint, then size the residual that remains. Do not pretend the unpaid pathway appeared on the drawing.

Budget is also a sequencing constraint. If year-one money will buy Door 4 hardware and a monitoring share, and year-two money might buy fiber, the year-one design must still reduce this year’s pairing. A “complete” campus package that cannot be purchased is not more professional than a funded first layer that actually latches.

Materials and constructability

Materials constrain what the building can accept. A hollow-core leaf will not become a vault door because the spec says “high security.” A fire-rated assembly may forbid the electric strike, maglock, or vision panel you wanted. A storefront mullion may not take the delayed-egress device the theft pairing asked for. Roof structure may not take another pan-tilt-zoom head. Masonry, gypsum, and heritage plaster take penetrations differently. If the material cannot carry the hardware, the hardware is not a design—it is a change order waiting to happen, or a field improvisation that voids a listing.

Constructability includes after-hours work, infection-control barriers in a hospital, and whether a dock can be taken out of service. A measure that can only be installed by shutting the only receiving door for two weeks may be correct technically and impossible operationally. That is still a design constraint.

System compatibility

Most PSP-style sites are not green fields. An existing access-control panel, card format, video-management license, intrusion communicator, and lock power supply already occupy the room. A “better” reader that will not talk to the installed controller is a stranded asset. A camera that needs a license tier the owner will not buy is not detection. Compatibility includes power budgets, network VLANs the IT standard will allow, and whether the existing head-end can even log the event you plan to require. Design to the installed ecosystem unless the residual pairing and the budget jointly justify a replacement—not because a demo was impressive.

Credential format is a quiet compatibility trap. If the campus still uses a Prox card the owner will not rebadge this year, a new reader family that only speaks a different protocol does not “upgrade security.” It creates two populations and a week of propped doors.

Heritage and listed buildings

Heritage fabric, landmark commissions, and conservation easements constrain visible devices, mortar matching, and new penetrations. You often cannot saw a limestone cornice for a camera raceway or face-mount a maglock on a documented historic leaf. Honest design uses existing openings, reversible mounts, interior positions, and finishes the commission will accept. Heritage is not a waiver of residual risk. It is a constraint on how you treat the pairing. If identification at the public door still matters, move the camera inside the vestibule rather than drilling the listed facade.

A worked museum example: street robbery residual at the public stair is real. The commission will not accept a modern bullet-resistant storefront on the 1890 elevation. The design constraint is “treat the pairing inside the existing masonry openings.” That may mean an airlock vestibule behind the historic leaf, identification cameras in the interior plane, and territorial cues on the stair—not a brochure curtain wall.

Owner standards

Corporate master specifications, finish palettes, preferred manufacturers, badge graphics, and IT network rules are owner standards. They can be stricter than the adopted code. They cannot waive the adopted code. If the owner standard names a lock series and the residual pairing needs a listed delayed-egress device that series does not offer, you write a specified substitution and a reason tied to the pairing—not a silent catalog swap. Owner IT rules that forbid security devices on the corporate LAN are a constraint: you design a dedicated pathway or you do not claim a network feature you cannot have.

Owner standards also include “no visible cameras in the board suite” and “all exterior devices must match bronze finish.” Those are real. They are not residual-risk analysis. Record them, then still name the pairing you are or are not treating.

Existing cable plant

The cable plant—copper pairs, fiber strands, pathway fill, homerun length, plenum rating, and Power-over-Ethernet budget—is a design constraint before it is a camera conversation. A specification that assumes thirty-two new 4K heads on a dock that has four spare pairs and a saturated PoE switch is fiction. Count spare media, measure distance, and name whether a pathway upgrade is in scope. If it is not in scope, the performance requirement you write for those cameras must fit the plant that exists, or you must change the residual you are willing to leave.

Cable plant includes the closet that is already out of rack units, the conduit that is already at fill, and the homerun that is already longer than the lock power supply can drive. Voltage drop on a maglock run is a constraint. So is a plenum ceiling that will not accept the cable jacket you named.

Risk-analysis results must drive design

A product catalog is a library of parts. It does not know this site’s residual pairings, this AHJ, this budget, or this cable plant. Independent OpenExamPrep teaching for published PSP Domain 2 tasks is that results from Domain 1—the ranked loss-event profiles, the inherent-versus-residual statements, and the treatment choice—become design inputs. If residual risk for opportunistic cargo theft remains because Door 4 is unlatched and unattended, the design problem is that opening and that how. It is not “buy the newest analytics platform.”

Write the conversion as a sentence you could put on a schematic:

1. Residual statement (from analysis): who/what, how, and what remains after current measures as they actually operate.
2. Function required (from Chapter 6 selection logic, now as a design demand): deter, detect, delay, deny, and the operational respond that people will actually perform.
3. Constraint filter: regulations, budget, materials, compatibility, heritage, owner standards, cable plant.
4. Shall statement: the opening, zone, or system shall provide named functions inside those filters, in language a later field test can fail.

If step 1 is missing, you are shopping. If step 3 is missing, you are drawing a fantasy. If step 4 cannot be tested, you have a slogan. Catalog pages can enter after step 4 as candidates that meet the shall-language. They do not get to rewrite the residual pairing so the favorite product looks necessary.

Trade-off: you cannot buy a SCIF for a retail stockroom

A Sensitive Compartmented Information Facility (SCIF) is a specialized construction and accreditation envelope used for certain classified work: controlled penetrations, tested isolation, strict access, and a documentation burden that exists because the residual pairing is disclosure of classified information. That envelope is the right intensity for that pairing.

A retail stockroom’s residual pairing is typically opportunistic theft of merchandise during restock, a propped door, or an insider walking a carton to a car. Specifying SCIF-level walls, specialized penetration control, and a classified-access ritual for that stockroom is over-control. Chapter 6 already warned that over-control gets bypassed and residual rises. Domain 2 adds the design reason: the constraint set—budget, egress, merchandise flow, owner standards, and the actual residual—cannot honestly support that envelope. You are not more professional because the construction is heavier. You are mismatched.

The same logic runs in the other direction. A cash vault, an infant nursery, or a genuine classified annex is not treated with a decorative camera and a hope. Intensity follows the residual pairing and the legal floor, then it is filtered through constraints. The catalog is not the intensity knob. Copying another campus’s SCIF spec into a strip-mall stockroom, or copying a stockroom latch into a classified annex, is the same error with opposite products.

Worked example: residual-risk statement to design constraint

Use the dock pairing from Domain 1, now written as a residual the owner has not accepted.

Residual statement: Opportunistic theft of palletized consumer electronics staged at Door 4 remains likely. The leaf is left unlatched during restock. No attendant is present. Apron cameras record to a recorder nobody watches. The latch hardware can talk to the existing access-control panel. The opening is a required path for merchandise, not a public exit stair. Heritage fabric is not involved. Budget will fund door hardware, a contact, and a monitored alarm path; it will not fund a classified construction package or a new fiber backbone.

Functions the residual still lacks: deny while unattended; detect in time to act; a person who can respond during the restock window.

Constraint filter:

• Regulation: keep merchandise movement on the dock; do not turn the leaf into a mantrap that fails the fire plan.
• Budget: hardware, contact, and a monitoring share; no SCIF.
• Materials: existing hollow-metal dock door can take an electric strike and a balanced magnetic switch; it cannot become a vault.
• Compatibility: strike and contact must land on the installed access-control panel and the existing copper homerun.
• Owner standard: finish and manufacturer series already in the master spec, unless a listed substitution is written.
• Cable plant: one spare pair remains; the design may not assume four new 4K heads.

Design constraints (shall language):

• Door 4 shall remain latched except during attended restock.
• Unattended unlatch shall alarm at a named console within a stated time.
• Hardware shall be electrically compatible with the existing panel and the remaining copper pair.
• Construction shall not introduce a SCIF envelope, a mantrap, or a pathway upgrade outside the funded scope.
• An attendant procedure is part of the design, not a footnote (preview of people as a countermeasure in 7.3).

That package is a design. “Install the integrator’s recommended dock kit” is not. The diagram below is the conversion loop. The next section gives you CPTED, layered defense, and the project words those shall statements will meet again in commissioning.