Why office access control does not transfer to a site
Most access control products were designed for buildings: a lobby, a lift core, a few hundred staff whose employment status changes slowly. A working site breaks every one of those assumptions. Construction sites, factories, warehouses and industrial facilities run populations that turn over weekly, sometimes daily. Subcontract crews arrive for a fortnight. Agency labour arrives for a shift. Delivery drivers arrive for twenty minutes. An access system that assumes a stable staff list spends its life fighting its own data.
The physical environment is different too. A card reader that behaves in a heated lobby has to survive rain, dust, gloves and impatient queues at seven in the morning. The network is different: sites run on temporary connectivity that drops, and a gate that fails shut when the connection does will have someone propping it open with a pallet by lunchtime. And the stakes are different, because the question a site has to answer is not just who opened the door, but who is inside the boundary right now, which is a safety question before it is a security one.
So the useful way to think about site access control is not as door security scaled up. It is a live population system with hardware at the edges: every gate decision is also an attendance event, and every attendance event is a line in the record you will one day have to defend.
The hardware: boundary gates, internal gates, and what sits between
The first design decision on any site is where the boundary actually is, because the boundary is where attendance begins and ends. A gate on the site perimeter means something different from a gate on a plant room door, and the system needs to know the difference. Pass inward through a boundary gate and you are on site: the register should say so. Pass outward and your day is closed. Pass through an internal gate and your location changes but your attendance does not. Systems that treat every reader identically produce registers full of people who apparently arrived four times and never left.
The hardware itself falls into a few families, and most sites end up with a mix.
Full-height turnstiles. The workhorse of the site boundary. One person per rotation, no tailgating, no climbing over. Slower than a speed gate but nearly impossible to defeat casually, which is why they guard perimeters rather than corridors.
Speed gates. Faster throughput and a friendlier face, suited to welfare buildings, main entrances and anywhere a queue forms at shift change. They trade some tailgating resistance for flow, so they work best where a gatehouse or camera can see them.
Maglocked doors. For internal rooms and controlled areas: plant rooms, stores, server and switch rooms, hazardous process areas. Cheap to fit, easy to overlook, and often the most important readers on site because of what sits behind them.
Readers in both directions. A reader on the way in but not the way out gives you half a record. Scanning both directions is what turns a gate log into attendance: first-in and last-out times, time on site, and a register that empties as people leave rather than growing all day.
Zones and permissions: who may go where, decided in advance
Once the boundary is handled, the interesting work moves inside it. A site is not one space. It is a set of zones with different rules: the general working area, the loading yard, the high-voltage room, the area under a lifting operation this week. Good access control models that directly, as zones with classifications, rather than as a flat list of doors.
A workable classification scheme has three tiers. Mandatory zones are the spaces everyone on site needs, welfare, general circulation, the main working area: anyone admitted to site should be granted these automatically, because making a supervisor tick forty boxes per starter guarantees the boxes stop being read. High-risk zones require an explicit grant: someone has decided this person, with this training, may enter this area. Restricted zones are the tightest tier, explicit grants only, short lists, and denied scans that somebody actually looks at.
Permissions should attach to the person or, where it is more honest, to the credential, and changes should take effect immediately. If a permit expires at four o'clock, or a contractor is stood down mid-shift, the gates need to know within moments, not after a nightly sync. A permission system with a propagation delay is a permission system with a window in it.
The test of a zone model is the deny. When someone without a grant presents at a restricted door, the gate should refuse, record who, where, which credential and why, and surface that denial to security while the person is still standing there.
Offline resilience: the gate must not care that the network is down
Site connectivity fails. Temporary masts, shared bearers, a groundworker through a duct: it will happen, and the access system's behaviour in that moment defines whether people trust it. There are only two honest designs. Either the gate keeps making correct decisions on its own, or it does not, in which case someone wedges it open and your access control is now a sign.
The right pattern is a controller at the gate that holds what it needs to decide locally: the permissions, the zone rules, the credential states. When the network drops, it keeps granting and refusing exactly as before, and it queues every scan it makes. When the connection returns, it replays that queue to the platform in order, as a signed batch, so the central record ends up complete and in sequence with nothing invented and nothing lost. From the point of view of the person at the turnstile, nothing happened at all.
This matters beyond convenience. Attendance built on gate scans is only trustworthy if outages do not punch holes in it. A register with a gap from 10:40 to 11:25 is a register you cannot run a roll call from. Queue-and-replay closes that gap after the fact; local decision-making means the site never stopped being controlled during it.
Cloud management versus the server in the site cabin
The traditional pattern put an access control server on the premises: a PC in the security office running vendor software, maintained by whoever remembered it existed. On a working site that pattern ages badly. Sites open, close and move. The cabin gets craned away at the end of the job. The one person who knew the server password left in March. And a server that only the security office can reach means the project team, the head office and the safety manager are all working from second-hand information.
A cloud platform inverts this. There is no on-premise server to house, patch or lose: the gates talk to the platform, and the platform is wherever you are. That buys several things that matter specifically to sites.
Remote gate management. Reboot a controller, run a health check, flush its queue or push an update from a desk miles away, and see the gate acknowledge the command live. No van, no ladder, no waiting for someone to be passing.
Telemetry you can act on. Live per-gate readings, CPU, temperature, memory, queue depth, uptime, colour-coded so a struggling controller is visible before it becomes a stuck turnstile at shift change.
Every site in one view. An organisation running several sites sees them all in one place: an interactive map per site with zones, gates and live occupancy, rather than one server per cabin and no overall picture.
Updates without visits. The software updates itself, silently and in stages, so gates and admin apps stay current without a maintenance window or a site visit. Security should communicate over cryptographic device identity with signed messaging in both directions, so the convenience of remote control does not become an opening.
Access is attendance is roll call: one dataset, three uses
The strongest argument for taking site access control seriously is what it makes possible downstream. Every boundary scan is an attendance event. Every attendance event updates a live register. And the live register is the only honest input to an emergency roll call. Sites that run these as three separate systems, an access vendor, a time-and-attendance vendor, a laminated muster list, spend their lives reconciling them and still cannot answer the fire marshal's question quickly.
When the gate and the register are the same system, the chain is short and defensible. A scan at the boundary opens a day; the outward scan closes it; the register in between is live, not reconstructed. Per-person movement history, hours and session timelines fall out of the same ledger, ready for a payroll query or a commercial dispute. And when the alarm sounds, the muster list is simply the register, frozen at the moment it matters, including the visitors and drivers a signing-in book always misses.
That is the standard worth buying against. Not the longest feature list, but the shortest path from a credential touching a reader to a record you would be happy to hand an auditor.
