Office Access Control Planning: Doors, Readers, Credentials and After-Hours Access

Office access control should make routine staff entry straightforward while keeping permissions, visitors and after-hours access accountable. A successful NZ office design follows actual working patterns, including shared entrances, cleaners and staff who work late, rather than applying one schedule to every door and user.

Map public and controlled areas

Mark reception, staff workspaces, meeting rooms, stores and any restricted equipment rooms. Identify shared tenancy interfaces and who owns each door. Public access during business hours may differ from staff access after reception closes. Write the intended transition for each opening. A main entrance schedule should not accidentally expose an internal restricted area simply because both doors are managed by the same system.

Build roles around work patterns

Create groups for ordinary staff, managers, cleaners and contractors, with appropriate area permissions and hours. Avoid assigning broad permanent access to solve a temporary exception. Decide who approves late-working permissions and how expiry is handled. Keep an administrative record of changes. Test a representative user in each role during and outside the schedule instead of relying on a single all-access test card.

Plan visitors and shared entrances

Define how visitors contact reception, are verified and reach the correct tenant. An intercom release event does not prove the visitor reached only the intended destination. Coordinate any lift or internal-door permissions with the host process. Review the actual doorphone and answering endpoint integration. Keep visitor credentials time-limited and define who returns, cancels or revokes them.

Coordinate after-hours alarms

Where access and intrusion systems exchange events, specify the exact arming or disarming rule and its failure response. A valid door credential should not automatically unset every alarm area unless the approved design requires that behaviour. Include late-working staff, cleaners and a denied-entry case. Confirm permissions and event labels on both platforms. Avoid implying that any two systems integrate merely because both offer relay inputs.

Make the door hardware suit the opening

Review the mechanical lock, closer, contact and exit method as a complete door assembly. Confirm accessibility and the approved escape path with the building team. A reader choice does not resolve a poorly closing door or unsuitable lock. Check voltage at the lock during operation and the behaviour on mains failure. Document who maintains the mechanical hardware and who handles controller faults.

Hand over administration and change control

Give the client a role matrix, door schedule and secure account handover. Train the designated administrator to issue, expire and revoke permissions and to investigate a forced or held-open event. Keep a controlled process for schedule changes over holidays. Review rights when staff change roles or leave. The office system should remain understandable after the original installer and first administrator have moved on.

Apply the design to the actual project

Use an office schedule matrix with door groups across ordinary hours, late work, cleaning and holiday periods. Present test credentials for each role and record expected access before changing the live configuration. Shared tenancy and reception changes need a named owner because an altered public-entry schedule can affect several occupants. Keep restricted internal spaces outside broad public unlock rules unless that access is explicitly intended.

Practise the administrator's most important tasks during handover. Issue a temporary visitor permission, change a staff role, expire a contractor and revoke a departing user's credential. Check the results after synchronisation at the relevant doors. Review a held-open event and identify who acts on it. Give the client a controlled holiday-change process and preserve the previous settings for recovery. This verifies that routine administration can maintain the intended design rather than relying indefinitely on the installer's all-access account or undocumented exceptions.

Separate security permissions from safe escape

Build permissions around roles and areas, then apply schedules and expiry dates. Give contractors time-limited access and allocate an owner to remove it. Use named operator accounts, restrict configuration rights and keep an audit trail of administrative changes. Test a valid credential, an expired credential and a credential without the required area permission. Include a revoked credential after synchronisation. Those tests reveal errors that a single successful presentation cannot show.

Entry control must be coordinated with the building's approved escape and accessibility arrangements. Do not treat a software unlock command as proof of acceptable emergency egress, and do not add an interlock that delays escape without the required design approval. Document the mechanical exit path, release devices and interfaces, with responsibility assigned to the relevant building professionals. New Zealand Building Code guidance on access routes and movement to a place of safety provides the starting point for the project's design review.

Office access control door and reader schedule

Before choosing hardware, create a door schedule that links every opening to its purpose, permitted users and behaviour in normal and exceptional conditions. For each door record its ID and location, door type and handing, mechanical locking arrangement, reader location, exit method, monitoring contacts, fire or emergency interface, controller connection, power supply, battery provision and responsible trade. Mark whether the door is normally locked, scheduled to unlock or released only after authorised presentation. Identify any shared-tenancy approval needed before schedules change.

These entries are examples, not a substitute for a site-specific schedule. Confirm the escape and accessible-route requirements for each actual opening with the appropriate building professionals.

Controller sizing, communications and resilience

Count controlled openings, not merely readers. A door with entry and exit readers may use two reader interfaces but only one controlled lock, while lift, turnstile or shared-entrance functions can introduce different input, output and licensing requirements. Check the controller's supported door count, reader interface type, input and relay capacity, expansion modules, event storage, user and credential limits, software licensing and network architecture against the selected model's current documentation.

Specify the intended operation when the controller loses its server connection, the office network is unavailable or mains power fails. Confirm whether local door decisions, event buffering and later synchronisation are supported, rather than assuming every platform behaves alike. Size standby power from actual lock, reader and controller loads, including inrush and the specified standby period. Test supply voltage under load at the furthest device, and document which components are backed up.

Lock fail-safe or fail-secure operation must be chosen for each approved door assembly with the building and fire design team. Neither term alone proves a compliant means of escape. Verify release on required emergency conditions, manual exit arrangements and accessible operation in the installed environment. A loss-of-power test should demonstrate the design's specified outcome without undermining evacuation.

Credentials, reader wiring and privacy

Choose credentials based on the site's threat level, administration needs and existing system support. Prefer a managed process that allows rapid deactivation of lost cards, role changes and temporary access. If mobile credentials or biometrics are proposed, verify device support, enrolment and revocation workflows, fallback entry and the privacy implications before committing. Avoid shared PINs for areas where individual accountability is required.

For new reader cabling, assess OSDP Secure Channel where the controller and reader genuinely support it. An OSDP-capable label is not proof Secure Channel has been enabled or commissioned. Confirm key management, compatible firmware, wiring topology and documented installation settings. Existing Wiegand interfaces may remain in an upgrade, but should be evaluated for their security limitations and risk acceptance rather than treated as equivalent to authenticated encrypted reader communication.

Define who may view access events and how long the records are retained. Capture the minimum personal information needed for the legitimate purpose, limit administrator privileges and document staff and visitor notice processes under the organisation's privacy policy and relevant NZ requirements.

Example access permissions matrix

Use this as an approval conversation, not a default programming template. The project owner should sign off each role and authorised exception, and commissioning should verify both expected access and expected denials.

Practical commissioning and handover records

Include tests for a revoked card while online, a network-disconnected controller where supported, an alarm arm/disarm exception, mains and standby supply transitions, door-held-open alarms and any fire-system interface test performed by the authorised trade. Record expected and observed behaviour, the software version, the person witnessing the test, corrective actions and retest evidence. Handover should include as-built drawings, a door and reader schedule, a role matrix, secure administrator credentials, maintenance contacts, backups and an agreed process for future changes.

Commissioning acceptance checklist

Agree the expected result before testing. Use the installed configuration and retain evidence of each outcome, including a failure that must be corrected. The following checks supplement the exact manufacturer procedures and the approved project design.

Repeat affected checks after a material equipment, software or site change. Keep the test record with the as-built schedule so the next maintainer can understand which configuration passed and which assumptions still need review.

Equipment candidates and specification checks

These are relevant active catalogue candidates for a project review, rather than a universal recommendation or a promise of immediate stock. Use the full product page and current manufacturer information to confirm the supplied variant and its role in your design.

• RBH-IRC-2000 - RBH Integra32 2-Door Controller (UL Listed) includes Enclosure with 13.8VDC, 2A power supply. Confirm the exact supplied configuration, relevant interfaces and installation requirements before including it in the equipment schedule.
• RBH-BFR350 - Blueline Fingerprint Reader, PIN Keypad and Card Reader. Confirm the exact supplied configuration, relevant interfaces and installation requirements before including it in the equipment schedule.
• R20K - Akuvox Palm-Size Doorphone Certified for Outdoor Usage. Confirm the exact supplied configuration, relevant interfaces and installation requirements before including it in the equipment schedule.

Review the relevant Essential Security Supplies equipment range alongside the intended workflow. For further context, read our related installer guide.

Frequently asked questions

Should every employee receive all-door access?

No. Use a least-privilege role matrix that gives each employee only the entrances and rooms required for their duties, with time restrictions where appropriate. Obtain approval for exceptions, promptly revoke access when roles change and verify denied access during commissioning.

Can access control automatically unset an alarm?

Sometimes, but only where the installed access and alarm platforms support a specifically designed and tested interface. Define which user or event may unset which alarm area, how failures are reported and what happens during communication loss. Never assume a valid card should disarm every alarm partition.

Does a reader solve mechanical door faults?

No. A reader controls authorisation, but reliable entry also depends on the physical door, latch, closer, electric locking device, exit hardware and power supply. Inspect and test the assembly, including emergency egress and loss-of-power behaviour, before accepting the door.

Primary references and technical scope

Use the primary manufacturer or technical reference for the claims it covers. General design guidance does not replace the selected product's installation manual. Confirm current firmware, model variants and the approved project requirements before ordering or commissioning.

Get specification help from Essential Security Supplies

Send your site layout, equipment schedule, intended workflow and any existing model details to Essential Security Supplies for specification help and a project quotation. Identify the functions that must be demonstrated and the interfaces owned by other contractors. Our enquiry route supports a documented equipment review without publishing prices or assuming unverified compatibility.