In an office building with several floors, departments or tenants, the question is not only who comes in through the main entrance. What matters more is who is allowed to be in a particular room and at what time. An access control system answers exactly that: it defines zones such as the main entrance, individual floors, meeting rooms, the server room, the archive and plant rooms, and gives each person precisely the rights they need.
The practical difference compared with mechanical keys is clearest when an employee leaves. Access is revoked with a single action in the software, with no lock cylinders to replace and no need to rely on the key being returned. This article describes how such a system is planned, which functions are needed, what components it consists of, and what to keep in mind regarding biometrics and evacuation.
Thinking in zones and permissions
Design starts not with the equipment but with the building layout. Every door that needs control is assigned to a zone, and zones are grouped into access levels. An access level is a combination of zones and a time schedule. For example, "Accounting" might mean the main entrance, the third floor and the archive on weekdays from 07:30 to 19:00, while "Cleaning" might mean the main entrance and all floors, but only from 18:00 to 22:00.
It is worth defining separate rules for weekdays, weekends and public holidays. That way there is no need for manual changes every time the building runs on a different schedule.
What the system should be able to do
- Several identification methods in one system: RFID card or tag, PIN code and mobile access via phone.
- Access levels by zone, floor and working hours: different rules for weekdays, weekends and holidays.
- Two-factor verification: card plus fingerprint for critical rooms such as the server room, cash office and archive.
- Anti-passback: a card cannot be passed back to another person so that they can enter too.
- Temporary passes: for visitors and contractors, valid for the day and limited to a defined route.
- Attendance records: actual entry and exit times as a basis for payroll and for reporting to the landlord.
- Real-time central monitoring: the state of every door (open, closed, forced) and alerts on attempted unauthorised entry or a door held open.
- Emergency release: on a signal from the building's fire alarm system, all evacuation doors unlock automatically.
- Autonomous operation: controllers keep working when the network is down.
- Battery backup for power.
- HR and payroll integration: synchronisation of employees and leave; when someone leaves, their rights are removed automatically.
What the system consists of
An example configuration for a building with around ten controlled doors includes:
- 10 biometric terminals with a colour display, mounted next to the doors. They support MIFARE RFID cards (13.56 MHz), fingerprint and PIN, and optionally a phone via Bluetooth or QR code.
- A server holding the central database of users, permissions and the event archive.
- Management software: enrolling people, access levels, schedules, monitoring and reports.
- Electromagnetic locks and door position sensors: the lock has an emergency release output, and the sensor shows whether the door is actually closed.
- Controllers and backup power: connected to the server over TCP/IP and to the readers via RS-485 or Wiegand.
- Cabling to every door.
- Installation, configuration and user enrolment: the stage at which zones, schedules and each person's actual rights are entered.
- Training for administrators and reception staff.
Technical parameters
| Parameter | Specification |
|---|---|
| Identification | MIFARE 13.56 MHz RFID card/tag, fingerprint, PIN; optional phone (Bluetooth/QR) |
| Terminals | biometric readers with colour display |
| Communication | TCP/IP to the server, RS-485/Wiegand to the controllers |
| Locking | electromagnetic locks with emergency release and door sensor |
| Autonomy | the controller works from its local database and buffers events |
| Power | battery-backed |
| Capacity | thousands of users and hundreds of thousands of events in the archive |
Evacuation and fire safety
Access control must never make it harder to leave the building in an emergency. The controllers are therefore connected to a dry contact of the existing fire alarm system. On a fire signal, all doors on escape routes unlock automatically. Electromagnetic locks by their nature release the door when power is lost, which is the desired behaviour for evacuation doors. Doors to critical rooms such as a cash office or server room may follow different logic, but this must be aligned with the building's fire safety requirements.
Personal data and biometrics
Under GDPR, biometric data is a special category of personal data, so using fingerprints requires careful consideration. Modern terminals do not store an image of the fingerprint but a mathematical template from which the fingerprint cannot be reconstructed. Even so, before introducing biometrics an organisation needs internal rules, an assessment of the legal basis and a data protection impact assessment. Where biometrics are not genuinely necessary, an equivalent card-and-PIN scheme offers a good level of security without processing sensitive data.
Benefits for building management
- No more keys, lock cylinder changes or unreturned keys from former employees.
- A clear trail of who entered where and when; after an incident, the answer takes seconds to find.
- Automatic attendance records instead of manual spreadsheets.
- Different rights for tenants, staff, cleaners and contractors.
- Safe evacuation thanks to automatic unlocking on a fire signal.
Common planning mistakes
- No door position sensor. The system cannot tell whether a door was forced or propped open, and door-held-open alerts do not work.
- Anti-passback without a reader on both sides. The function requires both entry and exit to be registered. If the door is opened from inside with a push button, the logic cannot be applied.
- No backup power. During a power cut, electromagnetic locks release and the building stays unlocked until power returns.
- Access levels that are too broad. When everyone gets "full access" for convenience, the system loses its purpose. A few clearly described levels work better.
- Manual revocation of rights. Without a link to the HR process, a former employee's card often stays active for weeks.
- Biometrics by default. Enrolling fingerprints everywhere without an impact assessment creates legal risk with no real need.
Quick checklist
- Is there a zone plan and a list of access levels with schedules?
- Are the controllers connected to the fire alarm system, and has the release been tested?
- Does every door have a position sensor and emergency release?
- Do the controllers and locks have battery backup?
- Is it defined how visitor passes are issued and returned?
- Is there a procedure for revoking rights when someone leaves?
- Has an impact assessment been carried out if biometrics are used?
Well-designed access control in an office building is at once a security tool, a source of attendance data and part of the evacuation safety system. That is why planning the zones, permissions and the link to the fire alarm is as important as choosing the readers themselves.
