Access Control, Visitor Management, and Site Protection
Controlling who and what enters
Access control rests on identification, authorisation, and recording. Identify the person or vehicle, verify they are authorised for that specific area and time, and record the movement. Know the vocabulary: access point, control point, challenge, escort, restricted area, key/credential control. Visitor management follows a repeatable sequence - greeting, purpose and host verification, identity check, badge issue (clearly distinguishable from staff), escort rule, and sign-out with badge recovery. Physical keys and cards must be issued against a register, reconciled, and recovered on exit; lost credentials are a security incident, not an administrative inconvenience.
Traps to watch
- Tailgating and piggybacking are the most common failures; anti-passback and single-entry turnstiles or challenge procedures exist to counter them.
- Courtesy bypass: letting a familiar face, senior manager, or contractor skip checks. Familiarity is not authorisation.
- Badge colour confusion: if visitor badges look like staff badges, the control has failed.
- Unrecovered credentials: a badge or key not returned is an open door; treat it as reportable.
- Escort drift: an escorted visitor left alone "for a minute" is an unauthorised person in a restricted area.
Rule of thumb
Every entry has a reason, a record, and a responsible host. If you cannot answer who authorised the entry and who owns the visitor, the entry is uncontrolled.
Worked example
A contractor arrives without a pass but is known to the site engineer. Correct handling: verify identity, confirm the work order and host, issue a contractor badge, apply the escort rule, log entry and expected exit, and recover the badge - not wave them through on recognition.