An access control system controls who can enter a building or area, when they can enter, and under what conditions. It replaces physical keys with credentials, readers, and software that grant or deny entry based on rules set by the organization. Most mid-to-large organizations use access control to manage entry across multiple sites, reduce the risk of lost or copied keys, and create a record of who accessed what and when.
Key takeaways
- An access control system decides who can enter a space, when, and under what conditions, replacing physical keys with credentials, readers, controllers, and management software.
- It works by presenting a credential at a reader, checking it against permissions stored on a controller, and granting or denying access in real time.
- Systems are grouped by deployment model (on-premises, cloud-based, or hybrid) and permission model (DAC, MAC, RBAC, or ABAC), with RBAC the most common in enterprise.
- Access control also provides real-time visibility, instant credential revocation, audit trails, and integration with video, intruder, perimeter, and HR systems. Gallagher Security's Command Centre manages this from a single platform.
How does an access control system work?
An access control system works through identification, authentication, and authorization stages. A credential is presented at a reader, the controller checks it against stored permissions, and access is granted or denied in real time.
Three components handle this process. The reader captures the credential (a card, fob, mobile signal, or biometric scan) at the door. The controller makes the access decision by checking that credential against rules held locally, which means a door keeps working even during a network outage. The management software is where administrators set permissions, build schedules, and review audit logs of every access event.
What are the key components of an access control system?
A modern access control system consists of five components that work together to manage and record who enters protected spaces.
Credentials
The credential proves identity at the door. Common types include cards and fobs, PINs, mobile credentials, and biometrics.
Readers
Readers capture the credential and pass that information to the controller. Reader types vary by credential format, from card readers to mobile-enabled terminals.
Controllers
Controllers process the access decision, checking the presented credential against stored rules and logging the outcome.
Management software
Management software is where permissions are configured, schedules are built, and reports are generated for audits or investigations.
System integration
Integration connects access control to other building and security systems, including video, perimeter security, intruder alarms, and HR platforms, so access events trigger or inform actions elsewhere.
What types of credentials can an access control system use?
Access control systems support four main credential types, each with a different balance of convenience and security.
| Credential type | Strength | Trade-off |
| Cards and fobs | Easy to issue and replace | Can be lost or cloned |
| PINs | Simple, no hardware needed | Can be shared between users |
| Mobile credentials | Convenient, growing adoption | Depends on device battery and connectivity |
| Biometrics | Highest assurance (fingerprint, face, iris) | Higher cost per reader |
High-security sites typically combine two or more credential types at sensitive doors, rather than relying on a single method.
What are the different types of access control systems?
Access control systems are categorized by their deployment model and by how access permissions are assigned.
Deployment models include:
- On-premises: hardware and software are hosted and managed on-site, giving the organization direct control over data and configuration.
- Cloud-based: management is hosted remotely, supporting faster deployment and easier remote administration.
- Hybrid: a mix of on-premises and cloud, often chosen to bridge existing infrastructure with cloud scalability or to meet data residency requirements.
Four permission models are common in use:
- Discretionary access control (DAC): the resource owner decides who gets access.
- Mandatory access control (MAC): access is set by a central authority based on classification levels.
- Role-based access control (RBAC): permission is assigned to a role rather than an individual, which is why most enterprise deployments use it. It makes managing large numbers of users across multiple sites practical, since a new starter simply gets added to the right role.
- Attribute-based access control (ABAC): access is based on attributes such as job title, location, or department. ABAC is the most flexible of the four models and is gaining adoption among organizations that need fine-grained, context-aware rules.
Gallagher's management software, Command Centre, supports role-based and attribute-based access control natively, scaling from a handful of doors to thousands of access points across multiple sites and countries from a single management interface.
What are the benefits of an access control system?
Access control does more than lock doors. It gives organizations visibility, accountability, and operational efficiency that key-based systems cannot provide.
- Eliminates the cost and risk of physical key management: no re-keying a building because a key went missing.
- Real-time visibility over who is on site: useful for evacuations, audits, and day-to-day site management.
- Instant credential revocation: when staff leave, their access is switched off immediately rather than waiting on a key handback.
- Audit trails for compliance: every access event is logged and reportable.
- Integration with CCTV, intruder alarms, and HR systems: reduces the administrative overhead of managing separate platforms.
- Scalability: the same system that secures one door can manage an entire enterprise estate.
How do access control systems integrate with other security technologies?
Modern access control systems work alongside the technology you already run.
Video: linking door events to camera footage lets security teams review exactly what happened at a specific access point, rather than scrubbing through hours of unrelated footage.
Intruder alarms: arming and disarming alarm zones can be tied to the last person to exit a building. Gallagher builds intruder detection natively into its Command Centre platform, rather than bolting it on through a third-party integration, which means access and alarm data sit in the same system from the start.
Perimeter and gate: perimeter security extends the same control out to the site boundary, where fence sensors, gates, and vehicle barriers report into the same platform. Gallagher's perimeter security system is a core product of Command Centre, the same platform that runs access control and intruder detection.
Identity and HR systems: connecting access control to identity and HR platforms keeps permissions in sync with employment status, so a role change or departure updates access automatically. Gallagher's integration ecosystem supports this kind of connection alongside video, building management, and other third-party systems.
What should you look for when choosing an access control system?
The right access control system depends on your site size, security requirements, existing infrastructure, and how you need to manage users over time. A single-site retail business has very different needs from a government facility running multiple buildings across several cities or states, and the deployment model and permission structure should reflect that.
Consider how the system will handle growth, whether it needs to support hybrid or multi-site management, and what level of credential assurance your environment demands. It's also worth checking how access integrates with the security and building systems you already run, since retrofitting integration later is more disruptive than planning for it upfront.
If you're evaluating options for your organization, Gallagher's access control solutions cover deployments from a single door through to multi-site enterprise estates.
Frequently asked questions about access control systems
What is the difference between physical and logical access control?
Physical access control manages entry to buildings, rooms, and physical spaces using readers, controllers, and credentials. Logical access control manages entry to digital systems, such as networks and applications, and is typically handled by IT security tools rather than physical security hardware.
Can a small business use an access control system?
Yes. Mobile-based, cloud-hosted access control systems give small businesses the same core functionality as enterprise systems, scaled to fewer doors and a simpler management interface.
How long does it take to install an access control system?
Installation time depends on the number of doors, the complexity of the site, and whether existing infrastructure can be reused. A single-door system can often be installed in a day, while multi-site enterprise deployments take longer to plan and roll out.
Is cloud-based access control more secure than on-premises?
Neither model is inherently more secure. Cloud-based systems offer faster deployment and easier remote management, while on-premises systems give organizations direct control over hardware, data, and configuration. The right choice depends on compliance requirements, data residency needs, and existing IT infrastructure.