The Discounted Rekey That Becomes a Code-of-Ethics Problem
You quote a 12-unit apartment building rekey at a flat per-unit price. Mid-job, the on-site manager asks you to also 'make a couple of master keys' for the building's maintenance staff so they can enter any unit. The lease you're shown says tenants must be given notice before entry except in emergencies, and the manager wants the master keys 'off the books' - no work order, cash, no record. You have already rekeyed 5 of the 12 units to a single keying system you designed. The manager says the owner 'doesn't need to know' and that the previous locksmith did it this way. You have a pinning kit and can cut the extra keys today.
1. Identify the professional and ethical issues in the manager's request and how they interact with the work already done.
Read the worked answer
Several issues stack here:
- 'Off the books' master keys create an unaccounted keying hierarchy. Master keys that open every unit are high-value credentials; issuing them with no record means no one can audit who holds them or revoke them. That is a security failure you would be creating.
- Tenant notice and entry rights are governed by the lease and law. You are not the enforcer, but building a covert master system facilitates entry the lease restricts - and you'd be doing it knowingly.
- The owner's authority. The manager may not have authority to authorize a master-key system or to spend on it off-record. 'The owner doesn't need to know' is a red flag about authority, not a reason to proceed.
- Your existing work. You already keyed 5 units to a system you designed. If a master hierarchy is added later without planning, you may have to re-pin those 5 units to make the master work correctly - so the decision affects work already done and billed.
The professional move is to treat master keying as a designed, documented system with authorized sign-off, not an add-on.
2. What do you say and do, and how do you protect the integrity of the keying system and your records?
Read the worked answer
Say: 'I can build a master-key system for the maintenance staff, but it has to be authorized by the owner and documented - I can't issue master keys off the books.' Offer the legitimate path:
- Get written authorization from the owner (or the person with authority) for a master-key system, including who receives keys and how they're controlled.
- Design the hierarchy properly (change key / master / grand master as needed) and check whether the 5 units already keyed can be brought into it or must be re-pinned; quote that honestly.
- Issue keys against a key control record: number issued, recipient, date, signature, and a revocation/return procedure.
- If the manager declines the authorized route, finish the contracted rekey only and do not create master keys.
Records: log the request and your decline of the off-books version; keep the authorized keying chart and issuance log. If the owner later authorizes it, the chart and log become the audit trail that makes the system defensible.