Most buyers already know what a visitor management system is. The question that decides a shortlist is narrower. What happens, mechanically, between a visitor checking in and a door unlocking for them?
That handoff is where visitor management system integration proves itself. True integration means the access decision happens automatically the moment a visitor checks in. Buyers comparing platforms need to see that visitor management system architecture at work, not take the word on faith.
It isn't an assumption, either. Gallagher's 2026 Security Industry Trends Report found integration is the most-selected system goal organizations have for their security systems over the next three to five years.
This article explains how a visitor management system works in Gallagher’s ecosystem, where visitor management, powered by Kenai, manages the visitor journey and Command Centre makes the access decision. It covers the architecture connecting the two, the six stages from pre-registration to automatic revocation, and what your IT or security team configures at each one.
Why "how it works" matters
Check-in and access control are handled by two separate systems unless the two share a record. When check-in doesn't trigger access on its own, someone still has to manually issue a badge or unlock a door by hand, which puts you right back in the position a digital front desk was supposed to solve.
That gap shows up in ways that matter. A visitor waits at a locked door while reception tracks down whoever can let them in. A contractor's credential stays active days after their visit ends because nobody remembered to revoke it. Nobody can say with certainty which areas a visitor actually reached, only which ones they were supposed to.
The visitor to access control workflow, step by step
Here's what that workflow actually looks like, start to finish.
Step 1: Pre-registration and identity capture
Before a visitor arrives, the visitor management system captures their name, host, company, and purpose of visit along with any agreements they've signed, safety induction completion, and expected duration. That isn't a form floating on its own. It's queued against a scheduled record the system already holds, which is what lets every later step run automatically instead of someone re-keying the same details at the door.
Walk-in’s works differently. With no pre-registration record to match against, identity verification and the access decision both happen at the point of check-in instead, which leans more heavily on the verification methods available on-site.
Step 2: Credential issuance before arrival
Once pre-registration is confirmed, the system provisions the visitor as a cardholder in Command Centre and applies the rules you’ve set to decide which credential they receive. A kiosk-only site might default every visitor to a QR code. A contractor returning weekly might get a different credential type to a one-off guest, and length of stay factors in too.
Activation timing is configurable as well. A visitor’s mobile credential can be made active for a set window before they sign in, so they can pass through the building’s first door and reach the check-in kiosk. This is particularly useful in coworking spaces and multi-tenant office buildings, where the kiosk often sits behind a shared entry point.
If you’re evaluating a mobile credential visitor management system, Gallagher applies the same logic to mobile credentials generally, whether the person carrying one is staff or a visitor.
Step 3: Check-in and identity verification on arrival
At check-in, verification confirms the person standing in front of you is the person who pre-registered. That might mean matching a QR code or mobile credential against the pre-registration record or facial recognition confirming identity against the photo captured at registration.
Another key verification method is a one-time passcode (OTP) sent by WhatsApp or SMS, which works well at sites that don’t use facial recognition. When a visitor presents an ID document, the system can also capture a photo of it and save it to the visitor’s profile, so the identity check is recorded with the rest of the visit.
If there’s an issue at the kiosk, hosts and receptionists can assist with check-in or complete it from the Kenai dashboard, so a failed scan or kiosk fault doesn’t hold up the visit.
Step 4: The access control handoff
This is the step that actually proves visitor management system and access control integration means something. Instead of getting a blanket credential, a contractor visiting two floors receives access to those floors’ only, with an expiry timestamp set to match their expected departure. Attempt to walk through a door outside that scope, and the reader denies it, because the access decision was written at check-in, not configured separately by someone in security afterwards.
That's the real difference between a front door that's logged and one that's monitored. A logged door tells you who walked through it after the fact. A monitored one decides who gets through it in the first place, using the record the visitor created the moment they checked in.
Rob Salzwedel, co-founder and CEO of Kenai, the platform behind Gallagher's Visitor Management Solution, describes the result for the organizations running it as “a single ecosystem that handles visitor and employee flows,” with visitor records and security operating as one system.
Step 5: Real-time monitoring and host or emergency notification
The moment a visitor arrives, their host is notified through the channels you’ve configured, whether SMS or email. A security dashboard shows real-time headcount by zone, not just a building-wide total.
That same live data feeds evacuation and muster workflows. Instead of a security team guessing who might still be inside during an emergency, they get an actual list of who's still in the building, built from the same check-in and access records the rest of the workflow already created.
Step 6: Automatic revocation and audit logging
Access doesn't stay live by default. It's revoked automatically when the visit closes triggered either when the visitor signs out or the credential reaches its expiry time.
Every one of those events writes to an audit record supporting GDPR and POPI aligned data practices, including consent management, data deletion, and exportable visit and access logs for audits.
What your IT and security team actually configure
None of this runs on its own. Someone sets up access groups for each zone in Command Centre, maps visitor types to the credential rules that govern them, configures which notification channels are active, and connects the system to whatever directory or identity system you already run.
Who owns that work depends on where you are in the rollout. Your Channel Partner installer typically handles the initial configuration, while day-to-day changes, adding a new visitor type or adjusting a notification rule, usually sit with your in-house admin.
Initial visitor management configuration generally takes minimal time. An End User can complete it themselves, though it's typically done by Channel Partner, since that requires the End User to grant them admin rights first.
What this looks like against a disconnected, point-solution system
When visitor management and access control run as separate systems, every access decision after check-in becomes a manual task. A visitor needs access to an area they weren't pre-cleared for. The receptionist can't grant it themself, so they call security, who has to manually look up the visitor, confirm who they're visiting, and unlock the door by hand, all while the visitor waits in the lobby.
In an integrated deployment like Step 4, the credential was already scoped, time-limited, and tied to an access decision made the moment check-in was confirmed, so the visitor simply walks through. That gap exists with any visitor platform that doesn't share a record with the access control system underneath it, and it is the clearest test of visitor management system integration during an evaluation.
See it in action
A visitor management system that's genuinely integrated closes that gap, because check-in and access control are reading from the same record from the first step onward. Book a demo and understand how a checked-in visitor becomes an access decision inside a Command Centre system. For what Command Centre configures beyond visitors, the Access Control solutions page covers the rest.