Role, legal framework and regulatory obligations of a crowd controller
This domain tests the statutory identity of a crowd controller in New Zealand and the boundary between regulated security work and police powers.
The COA regime
Under the Private Security Personnel and Private Investigators Act 2010, a crowd controller is private security personnel engaged to monitor or control behaviour at events or premises. The individual must hold a current Certificate of Approval (COA) for the crowd controller class; the employer must hold a security business licence. A COA is not a licence to enforce law. It is a fitness-to-work credential: the Licensing Authority considers age, criminal history, training and whether the person is fit and proper. Conditions can be imposed, suspended or cancelled. While working, carry the COA and produce it on request to Police or an authorised person.
Core limits
Your authority comes from the occupier, the event organiser and ordinary law, not from any crowd controller statute. You may refuse entry, ask a person to leave, use reasonable force in self-defence or defence of others, and in limited circumstances make a citizen's arrest. You must not search a person, demand ID as if you were Police, or detain someone for convenience. Record-keeping, reporting changes and complying with the code of conduct are regulatory obligations.
Worked example
A venue puts a new starter on the door "just to watch" while their COA application is pending. That is still crowd control work. The starter and the employer risk enforcement action. Check the COA class and expiry before deployment; supervise only within the Act and employer policy.
Traps
Thinking a company licence covers every worker; confusing COA classes; assuming training alone authorises work; failing to carry or produce the COA.