Access Control

How It Works & Technology Overview

An electronic access control system has four layers: credentials (cards, fobs, mobile, PIN, biometric), readers at the door, locking hardware on the door, and a controller that makes the grant/deny decision and logs events. Controllers are either centralized panels in a closet (traditional, serving 2–16 doors each) or edge/IP controllers at the door (one network drop and PoE per door, no home-run wiring). Management software is on-prem server, appliance, or cloud-hosted.

Locking hardware is the load-bearing choice. Electric strikes replace the door frame's strike plate and are fail-secure by default; electrified mortise or cylindrical locks put the electronics in the lock body and need a power transfer hinge; magnetic locks bond the door shut and are always fail-safe, which drags in egress-code requirements (motion-release sensor, push-to-exit button, fire-alarm power drop). Every controlled opening also typically needs a request-to-exit (REX) device and a door position switch (DPS) so the system can distinguish authorized exits from forced doors.

Credential technology matters at scope time: legacy 125 kHz proximity is cloneable and being phased out; 13.56 MHz smartcards (MIFARE/DESFire, HID iCLASS/SEOS) and mobile credentials are current practice; OSDP is the modern reader-to-controller protocol (supervised, encrypted), replacing unsupervised Wiegand.

Common Deployment Scenarios

• Small commercial (1–8 doors): cloud-managed edge controllers or a small panel, mobile-first credentials, no dedicated server. Fast installs; IT coordination is the long pole.
• Mid-size office (8–64 doors): panel-based or hybrid, integration with video and visitor management, elevator control appears here.
• Enterprise/campus: partitioned multi-tenant databases, HR-directory integration (automatic provisioning/deprovisioning), high-security zones with multi-factor readers, mantraps, anti-passback.
• Retrofit/takeover: new heads on existing wiring and existing (often undocumented) door hardware — survey-driven, and the cardholder database migration is its own task.

A typical fully-dressed single door includes: reader, electrified lock, REX (often PIR), DPS, and multi-conductor composite cable back to the panel (or a single Cat6 for edge controllers). Two-person crews are the norm for door hardware work.

Products, Vendors & Characteristics

• Traditional panel platforms: Lenel S2, Software House (C-CURE), Honeywell, Gallagher — enterprise depth, integrator-certified programming, licensing per reader/feature.
• Mid-market panels: Mercury-hardware-based platforms (many brands ship Mercury boards under their own software — this is why "takeover without rip-out" is often possible), DSX, Keri.
• Cloud-native: Verkada, Rhombus, Brivo, Openpath/Avigilon Alta, Kisi — subscription-licensed, fast to deploy, IT/network coordination replaces panel wiring as the main effort; firmware and features update from the cloud.
• Locking hardware: Allegion (Schlage/Von Duprin), ASSA ABLOY (HES/Securitron/Sargent) dominate; electrified exit devices and auto-operators come from the same families.

Cloud platforms price per door per year; panel platforms price in hardware plus software licensing plus certification-restricted labor. Biometric readers add per-user enrollment work, not just install time.

What Makes It Hard (Gotchas & Failure Modes)

• Egress and fire code override everything. Any lock on an egress path must allow free mechanical exit; fire-rated doors restrict hardware modification (field-drilling a rated door can void its listing); mag-locks and delayed-egress require AHJ-specific code compliance and fire-alarm interconnection. Final testing of the fire drop requires the fire alarm contractor present.
• Door and frame construction dictates labor. Hollow metal is routine; aluminum storefront needs specialty hardware; frameless glass (Herculite) needs rail-mounted locks; wood doors and historic frames need carpentry coordination. "Existing door schedule" documents are unreliable — verify openings physically.
• Power delivery. Every door needs power: either a home-run to a supervised power supply with battery backup, or PoE with enough budget. Inrush current on latch-retraction exit devices far exceeds steady-state draw — undersized supplies cause intermittent failures.
• Panel capacity cliffs. "Add one door" to a full panel cascades into a new controller, enclosure, and power supply.
• Credential format mismatches. Existing card populations lock you into a format or force a card swap; facility codes and bit formats must be confirmed before readers are ordered.
• Dirty cardholder data. Client-provided user lists are inconsistent; database cleanup and enrollment is real labor, as is HR/directory integration testing.
• Licensing. Low-voltage/security licensing varies by state; some jurisdictions require licensed alarm or electrical contractors for portions of the work.

Effort & Estimation Patterns

• Standard interior door, existing hollow metal frame, panel nearby: 3–4 hours installed, programmed, commissioned.
• Storefront/glass door with surface hardware: similar mechanical time, more electrical fiddling; frameless glass specialty hardware: add 1–2 hours.
• Door requiring core drilling through masonry/concrete for power: roughly double the standard door.
• Edge/cloud controller doors on existing cabling: often 2–3 hours per door; the network/firewall coordination with client IT is a separate line (commonly 2–4 hours per project, more in 802.1X environments).
• Panel installation, power supplies, and head-end dress-out: 4–8 hours per panel depending on door count.
• System programming (schedules, access levels, holidays, partitions): scales with organizational complexity, not door count — 2 hours for a simple office, days for multi-tenant or campus rules.
• Biometric readers: add 30–45 minutes per door plus enrollment time per user.
• Database build/migration from client data: budget explicitly; treat imports as dirty until proven clean.
• Multiplier conditions: occupied/secure sites (escorts, work windows), historic/concrete construction (conduit labor), ADA auto-operator coordination (timing relays + field coordination with the door contractor), and fire-alarm interface testing (schedule-dependent on another contractor).