Access Control Overview
What This Capability Provides
The Access Control Capability provides complete management of physical door and entry access within a Zipato deployment. It manages access points (locks, readers), credentials (PIN, NFC, fingerprint, web), time-based access profiles, and maintains a full audit trail of all access events.
Like the Alarm capability, it is built as a virtual device on top of the standard device model — there is a single AccessControl virtual device per system, with access points modeled as its child endpoints.
It is not a standalone product. It runs on top of the Core Platform, using the normalized device model to deliver access control logic that any application or integration can consume.
Core Model
Access Control Device
The capability is structured around a virtual access control device. This device appears in the platform device tree alongside physical devices. All access points and their credentials are managed through it.
Access Control (virtual device)
└── Access Point (one or more)
├── Door Lock or Relay (actuator)
├── Keypad, Card Reader, or Fingerprint Reader (authenticators)
└── Optional Security Camera
This structure separates the logical access control model from the physical devices that perform the unlock. Any supported lock or reader — Z-Wave smart lock, Zigbee keypad, NFC card reader, fingerprint scanner — can be attached to an access point regardless of its protocol.
Access Points
An access point is a logical grouping representing a single door or entry point. Each access point has:
- an actuator — the physical lock or relay that performs the unlock;
- one or more authenticators — the physical readers or keypads where users present credentials;
- optional linked cameras — security cameras recording events at this door;
- capacity limits — maximum users, concurrent access schedules, and weekly schedule slots.
Learn more about Access Points
Credentials
A credential is an authentication method — the "key" a user presents to unlock a door. The capability supports four credential types:
| Type | How It Works |
|---|---|
| PIN | 4–10 digit numeric code entered at a keypad |
| NFC | Proximity card or tag read by a card reader |
| FINGERPRINT | Biometric fingerprint matched by a fingerprint reader |
| WEB | Secret token used for mobile app or API unlock |
Credentials are managed at the system level and can be assigned to multiple access points via access profiles.
Access Profiles
An access profile defines which credential is allowed to access which doors and when.
Each profile has:
- an associated credential (PIN, card, fingerprint, or web token);
- a weekly schedule defining allowed days and times (e.g., "Monday–Friday 8am–5pm");
- a validity window — an absolute start and end date for the profile;
- assignment to access points — which doors this profile grants access to.
Profiles can be activated and deactivated independently per access point, allowing flexible per-door policies. For example, one credential might have office-hours access to the main entrance but 24/7 access to the loading dock.
Learn more about Access Profiles
Access Flow
When a user attempts to access a door:
Key decisions at each step:
- Credential validation: Does this credential exist and is it active?
- Profile matching: Which access profiles use this credential?
- Schedule check: Is the current day and time within the profile's schedule?
- Access decision: If all conditions are met, unlock. Otherwise, deny.
- Audit recording: Every attempt (success or failure) is logged for compliance.
Web-based unlocks follow the same logic but use a secure token instead of physical presentation.
Learn more about how access events flow through the system
Roles and Permissions
Access Control uses role-based access control to determine who can configure doors, manage credentials, and view audit logs.
| Role | Who | Permissions |
|---|---|---|
| Access Control Admin | Security officer, IT administrator | Full management: create/configure doors, manage all credentials, create access profiles, view complete audit logs |
| Access Control Credential Manager | Facility manager, building operations | Manage credentials and access profiles; assign/revoke access; view audit logs for permitted doors |
Users can be assigned time-limited roles — for example, a temporary credential manager role for a specific project or period.
Audit Trail
All access attempts, credential changes, and configuration updates are recorded in the audit log. Each entry captures:
- What happened — credential used, door accessed, configuration changed, etc.
- When — timestamp of the event
- Who — the user who initiated the action (if applicable)
- Which door — the access point involved
- Status — success or error details
Security events (successful access, failed attempts, profile activations) and administrative events (credential creation, configuration changes) are logged separately for compliance and investigation.
Learn more about Audit Logging
How It Fits the Platform
The Access Control Capability consumes Core Platform services:
- the normalized device model provides locks, keypads and readers regardless of protocol;
- the device control layer sends unlock commands to the edge runtime;
- the event stream delivers real-time access attempts to be logged;
- the data storage layer persists credentials, profiles, and audit logs.
Access control logic runs on the edge runtime so that doors remain functional even when cloud connectivity is intermittent. Credentials are cached locally on the hub, allowing offline unlock validation.
Where to Continue
| Goal | Page |
|---|---|
| Understand how to create and configure access points and doors | Access Points |
| Learn how credentials and access profiles work | Credentials and Profiles |
| Explore roles, permissions, and audit logging | Roles, Permissions & Audit |
| Understand the normalized device model that feeds access control | Device Normalization |
| See how access control events flow through the platform | Device Control & Events |