Access Control
Principles
Access control is the practice of deciding who may enter where, when, and under what conditions, and then verifying it every time. The four classic components are identification (who claims to be), authentication (proof of that claim - badge, PIN, biometric, photo ID), authorization (what that identity is permitted to do), and accountability (a record of the event). A guard at a post is a human layer in a layered system that includes locks, badges, turnstiles, and cameras.
Post-level concepts
Know the difference between positive and negative access control: positive means you verify every entrant against a list or credential; negative means you allow everyone except those specifically excluded (common at public events). Understand tailgating (an unauthorized person following an authorized one through a door) and piggybacking (the same thing with the authorized person's consent). Both are defeated by one-person-at-a-time procedures, vestibules, and polite challenge. Know the challenge procedure: approach, greet, state the requirement, request identification, verify against the list, log the entry, and direct the visitor. Know that visitor badges should be visually distinct, time-limited, and collected on exit. Package and delivery control - checking against a manifest and never letting a courier self-escort - is a frequent exam topic.
Traps and rule of thumb
The main traps are assuming a uniform or a badge is proof of authorization (it must be verified), leaving a door propped, and "being polite" by waiving the check for a familiar face or an executive. Rule of thumb: no credential, no verified entry - and every exception gets documented.