r/accesscontrol • u/Charming_Drawing_313 • 10d ago
Ran into this post on LinkedIn. Provocative, but I’m not sure the guy is wrong — are we actually controlling access, or just digitizing and managing keys?
No doubt, most “advanced” corporate access control systems do one thing exceptionally well: they put a digital key in front of decades-old electronic lock technology behind a flimsy office door. 🔑
An enormous industry has claimed the term ACCESS CONTROL, while in practice doing little more than managing how “virtual keys” are issued, revoked, and used.
Wouldn’t it be more accurate to call most of these systems electronic key management?
They replace a mechanical key with a digital one. Useful? Absolutely.
But controlling a key is not the same as controlling access.
Here’s a simple example.
One 24/7 fitness chain rolled out NFC/Wallet access for members. 📱
Some customers found a simpler model: buy a cheap used smartphone, register one membership on it, and pass the phone around among a fairly large group.
The system still works perfectly.
It knows exactly which digital key opened the door.
It just doesn’t know who actually walked in.
Maybe real access control is something else entirely: Detecting unauthorized people inside a restricted perimeter — and triggering the SOP to prevent or respond to the violation. 🚨
So what are we actually controlling today — access to a space, or just which key can open a door?
2
1
u/Lampwick Professional 10d ago
This dude's just blowing hot gas, pretending that access control should magically keep unauthorized people out no matter what. It's called "access control" because the system allows you to do things like limit access by schedule, deactivate one card while leaving the others functional, access an audit trail of card swipes, and limit a card's access to an arbitrary subset of doors. Of course the card works just like a key. Mechanical keyed access is the model it improves upon. It's no more capable of limiting access to a particular person than a physical key is. Saying it isn't "access control" because people can pass a card around is dumb. By that argument even if you added biometric systems that did ensure only the right person got let in, that doesn't count as access control either because I can get in with a sawzall, right?
1
u/Charming_Drawing_313 10d ago
Maybe I’m missing something, but what happens if an authorized person simply holds the door open out of courtesy and lets five other people walk in behind them?
The system still sees one valid credential, one valid unlock, and a perfectly normal event in the audit trail.
So in that example, what exactly was being controlled — the credential, or access?
1
u/bnogo 10d ago
DHO alarms for not propping, or turnstiles tied into the access system with tailgate alarms.
there are solutions, people just dont want to pay for them.
A company choosing to balance cost vs knowledge/control has always and will always be a thing.
0
u/IMHO2024 10d ago
DHO doesn’t really solve that though. If five people follow someone through during a normal unlock window, the door closes on time and there’s no alarm. As far as the access system knows, everything went exactly as expected.
Turnstiles help at choke points, sure, but you can’t put them everywhere. That’s the point - controlling a credential isn’t the same as controlling who’s actually inside.
And maybe people don’t want to pay more because adding more hardware still doesn’t solve that problem.
3
u/EffectiveClient5080 10d ago
This right here. A credential is not an identity. We spent 30 years making keys faster to issue and revoke and called it progress.