Badge That Doesn't Belong
You staff the lobby desk of a 12-story medical office building from 6 a.m. to 2 p.m. Access control is badge-only after 7 p.m., but during the day visitors sign in and receive a temporary sticker. At 11:40 a.m. a man in scrubs walks briskly past the desk toward the elevator bank without stopping. You call out; he waves a badge over his shoulder without slowing and says, "I'm with the 9th-floor clinic, I'm late." The badge is visible only for a second. You cannot read the photo or the floor designation. The 9th floor houses two separate practices, one of which has had a recent complaint about an unauthorized person in its back office. Your post orders say to challenge anyone not wearing a visible visitor sticker and to verify badges on request.
1. What is the appropriate immediate response, and how do you balance courtesy with the access-control requirement?
Read the worked answer
The badge-waving move is a classic tailgating/piggyback attempt, whether innocent or not. The recent complaint raises the stakes.
- Move to intercept politely but firmly before he reaches a closed elevator: "Sir, I just need to scan that badge-takes five seconds." Position yourself so you are not blocking physically but are clearly engaging.
- Do not accept a verbal claim ("I'm with the clinic") as verification. The post order is verify on request; a rushed staff member is still subject to it.
- If he refuses or keeps moving, note the elevator he takes, the time, and his description, and call the 9th-floor clinic(s) to confirm whether he is expected, while notifying your supervisor.
- Never physically restrain a non-violent person over a badge check; escalate through notification and documentation instead.
Reasoning: the requirement is verification, but the method must stay proportionate. The complaint history means an unverified person on 9 is a real risk, so confirmation by phone is the fallback when the badge check fails.
2. Suppose he does stop and the badge is valid but belongs to a different building in the same management portfolio. What do you do, and what does this tell you about the control?
Read the worked answer
A valid-looking badge for a different property is not authorization for this one.
- Deny unescorted access to the floors and direct him to sign in as a visitor, or have the 9th-floor clinic sponsor him and come to the lobby.
- Document the badge number/property, time, and outcome.
- Report the pattern to the supervisor: portfolio-wide badges that open or appear to authorize access across sites are a systemic gap, not a one-off.
The lesson: "the badge scanned/beeped" is not the same as "this person is authorized here." Access control is site-specific, and a plausible credential can still be the wrong credential.