What QR access control actually is
Strip away the marketing and a QR access system is simple. The system generates a code, a small printed maze of squares that encodes a reference. The code goes to the person, usually by email or inside an app, and they present it at a reader, most often a camera or scanner at the entrance. The reader decodes the reference, the system looks it up, and the door or barrier is told to open or stay shut.
The crucial thing to understand is what the code is: a pointer, not an identity. The QR code says this reference was issued to this record. It says nothing about who is holding the phone. Everything else about QR access control, its economics, its convenience and its weaknesses, follows from that one fact.
The appeal is real and worth stating plainly. There is no credential stock to buy, encode, hand over or chase when people leave. Issue is instant and remote: a code can be in someone's inbox seconds after they are approved. Nobody has to visit a desk before their first visit. For an organisation with a lot of short, low-stakes visits and no appetite for hardware, that is a genuinely attractive set of properties.
The failure modes, one by one
The problems appear when QR moves from the lobby to the gate line, because a working site stresses exactly the assumptions QR relies on. None of these are edge cases. Anyone who has stood in a gatehouse through a winter shift change will recognise all of them.
A code is a picture, and pictures copy. A screenshot of a QR code is a perfect duplicate of it. It can be forwarded to a group chat in seconds, and the system cannot tell the copy from the original. Rotating codes narrow the window but do not change the nature of the thing: a credential that can be photographed is a credential that can be shared.
The phone is a single point of failure. Phones die mid-shift, get dropped in the yard, get left in the van, get left at home. Every one of those events becomes a queue at the gatehouse and an improvised workaround. And on plenty of sites, phones are banned outright in certain zones, which puts the credential on the wrong side of the rule it is supposed to enforce.
Scanning is an optical process in a non-optical environment. QR needs a clean line of sight between a screen and a camera. Rain on the glass, glare at a low sun, a cracked screen, brightness turned down, gloves working a lock screen: each one adds seconds, and seconds multiplied by a shift change is a crowd at a turnstile. A tap credential works through all of it.
There is nothing to hand back. When someone finishes on site, a physical credential is surrendered, and its return is an event you can see and record. A QR code lives on in a photo library indefinitely. Departure becomes an administrative deletion you have to remember, rather than a token changing hands at the gate.
The link between code and person is weak. Access control on a working site exists to answer who: who entered the restricted area, who was inside at the alarm, who was refused and why. A record built on QR scans says a code was presented. Whether the right person presented it is an assumption, and assumptions are what fall over first in an investigation.
Where QR is a perfectly reasonable choice
Fairness matters here, because QR is not a bad technology. It is a technology with a narrow honest range, and inside that range it is hard to beat.
The clearest fit is the supervised, low-risk visitor lobby: a reception desk, a member of staff watching, visitors who are escorted once inside and pose no risk to themselves or the operation. In that setting the weaknesses mostly do not bite. Sharing a code gains an intruder little when a receptionist checks everyone in anyway. A dead phone is a small inconvenience at a warm desk, not a blocked turnstile in the rain. And the economics are excellent for populations that visit once and never return.
QR also earns its keep in adjacent jobs that are not access control at all: linking to documents, confirming a booking, pulling up a delivery reference. The mistake is not using QR. The mistake is promoting a lobby convenience into the thing that guards a boundary, a high-risk zone or a muster list.
A useful rule of thumb: QR is fine wherever a person is already doing the real checking. The moment the code itself is the control, you have outgrown it.
What working sites need from a credential
Turn the QR weaknesses around and you get a specification. A credential fit for a working site should be a physical token, issued to one named person, that cannot be duplicated with a camera. It should work first time in rain, in gloves, in the dark, at walking pace. It should be revocable from a desk, instantly, without needing the token back first. It should be cheap enough to issue to a subcontract crew and recoverable when they leave. And every use of it should land in a permanent record: who, where, which direction, granted or refused, and why.
NFC credentials read by secured controllers meet that specification, and they preserve most of what made QR attractive in the first place. Presentation is a tap, faster than aligning a screen with a camera. Issue can happen at the point of arrival in seconds. And the tie between token and person is something the system enforces rather than assumes, because the credential is registered to an individual and every scan is checked against live permissions at the moment of the tap.
The controller matters as much as the token. A reader that trusts whatever it is shown is only half a control. The gate hardware should hold a cryptographic device identity and exchange signed, replay-protected messages with the platform, so that a scan cannot be faked, an instruction cannot be forged, and the record of what happened is one both sides agree on.
How Site Commander approaches the same problem
Site Commander is built on the physical-credential pattern, applied end to end. Credentials come in seven types, so a permanent employee, a long-term contractor and a one-day visitor do not have to be forced through the same shape of token. Issue is tap-to-create at the desk: touch a blank credential to the reader and assign it to a person in moments, which keeps the arrival experience close to the instant-issue convenience that draws people to QR. A 24-hour loaner flow covers the forgotten-credential morning without creating a permanent ghost, and expiry dates are enforced at the gate, not just noted in a record.
Revocation is the sharp edge. When a credential is lost, or a person is stood down, one action revokes it and the change propagates to every affected controller immediately. The next tap is refused, the refusal is logged with the reason, and denied scans surface live to security. That is the property no shareable picture can offer: a token that is on or off, per person, right now, with proof either way.
Underneath, the gates run on PKI-secured controllers with NFC readers in both directions, signed messaging both ways, and a permanent ledger of every scan: person, credential, zone, direction, decision, deny reason. Inward and outward reads mean the same tap that opens the gate also maintains the live register, so access, attendance and the emergency roll call are one dataset rather than three systems arguing.
