Access Control, Screening, and Physical Security
The Access Control Principle
Access control answers three questions: who may enter, where may they go, and when. Controls include identification checks, badges, visitor logs, escort rules, keys, and electronic systems. The core principle is least privilege - grant only the access needed for the role. Know the difference between authentication (proving identity) and authorization (what they may do).
Screening
Screening may involve badge verification, visitor registration, package inspection, or metal detection. Screening must be consistent, courteous, and lawful, applied to everyone equally to avoid discrimination claims. Know the limits: consent-based screening, posted policies, and the right to refuse entry. Trap: questions ask whether you may search a bag without consent. Generally, you may deny entry or ask the person to leave, but a forced search can create liability. Follow policy and call police if needed.
Physical Security Layers
Understand defense in depth: perimeter, building envelope, interior zones, and asset-level protection. Know how CPTED (crime prevention through environmental design) uses lighting, sightlines, and landscaping. Tailgating and piggybacking are common breaches - one badge, one person.
Worked Example
A visitor arrives without an appointment and asks to see an executive. You verify identity, call the executive's office, log the visitor, issue a temporary badge, and arrange an escort. If the office declines, you politely deny entry and document the interaction. You do not allow unescorted access because the person "seems legitimate."