Access Control and Identification Procedures
The principle is least privilege
Access control grants the minimum access needed for a role, for the minimum time, and verifies it every time. Credentials - badges, keys, PINs, codes, biometrics - are evidence of identity only if issuance is controlled. Know your system: who authorizes access, who issues credentials, how lost or stolen ones are deactivated, and how visitors are sponsored, logged, badged, and escorted.
Challenge everyone
The most common failures are social, not technical: tailgating and piggybacking, holding doors, letting familiar faces skip verification, and accepting a uniform or name badge as proof. Use a consistent challenge: approach politely, identify yourself, ask for the credential and the purpose of the visit, verify against the system or list, and thank the person. Escalate refusals to your supervisor rather than into a confrontation.
Visitors and contractors
Verify identity, confirm the appointment or authorization, issue a visible badge, record time in and out, explain rules, and require an escort where post orders say so. Inspect deliveries per procedure; urgency is never a reason to skip verification.
Traps
'He had a badge, so he's authorized' - badges expire, get shared, and get stolen. 'I know her, she works here' - familiarity is not verification. Also watch sharing your own credentials, propping doors, and disabling alarms for convenience.
Rule of thumb
Verify, then verify again: possession of a credential is not proof of identity, and identity is not proof of authorization.