Roles, Permissions & Audit
What This Page Covers
This page explains how role-based access control (RBAC) works in Access Control, how administrative permissions are managed, and how the platform maintains a complete audit trail of all access and administrative events for compliance and investigation.
Role Model
Access Control uses role-based access control to determine who can configure access points, manage credentials, and view audit logs. Two system-wide roles are available:
Access Control Admin
Permissions: Create/configure/delete access points, manage all credentials, create access profiles, view complete audit logs, manage user roles
Access Control Credential Manager
Permissions: Create credentials and access profiles, assign/revoke access, activate/deactivate profiles, view audit logs for doors they manage
Limitations: Cannot create/delete access points, cannot view audit logs for doors outside their permission scope
Role Assignment and Time-Limiting
Roles can be assigned to users and set to expire after a certain date. For example:
- Assign someone as a Credential Manager for January 1–March 31, 2026 (temporary role for a specific project)
- Assign someone as Admin permanently (no expiration)
- Assign someone as both Admin and Credential Manager simultaneously (roles can overlap)
When a role expires, the user loses the associated permissions automatically.
Device-Level Permissions
In addition to roles, non-admin users have device-level permissions that restrict which access points they can manage.
An admin user can manage any access point. A credential manager can only manage access points where they have explicit permission granted. This allows:
- Facility manager for Building A to manage doors in Building A only
- Facility manager for Building B to manage doors in Building B only
- Each sees only the access points they have permission for
When you revoke a credential manager's permission to a specific access point:
- All profiles that person assigned are automatically deactivated
- All credentials they were managing remain in the database but become inaccessible
- Any in-progress provisioning is cancelled
Permissions in Practice
What an Admin Can Do
- Create access points, configure new doors
- Manage all credentials (create, reset, deactivate, delete)
- Create and assign access profiles to any access point
- Activate and deactivate profiles system-wide
- View the complete audit log
- Assign roles to other users
- Grant/revoke device-level permissions
What a Credential Manager Can Do
- Create credentials (PIN, NFC, fingerprint, web)
- Reset PINs and web credentials
- Create and update access profiles
- Assign profiles to access points they have permission for
- Activate and deactivate profiles on their permitted doors
- Bulk deactivate all profiles using a compromised credential
- View audit logs for their permitted doors
Audit Trail
All significant operations and access events are recorded in the audit log. Each entry captures:
| Field | What It Records |
|---|---|
| What happened | Credential used, door accessed, configuration changed, etc. |
| When | Timestamp of the event |
| Who | User who initiated the action (or null if hub-initiated) |
| Which door | The access point involved (if applicable) |
| Status | Success or error details |
Types of Events in the Audit Log
Access Events — When users attempt to access doors:
- Successful access via PIN, NFC, fingerprint, or web token
- Failed access attempts (wrong credential, outside schedule, etc.)
- Who accessed which door and when
Administrative Events — When the system is configured:
- Credentials created, reset, deactivated, or deleted
- Access profiles created, updated, or assigned to doors
- Access points created or modified
- User permissions granted or revoked
System Events — When the platform itself makes changes:
- Profiles automatically deactivated due to credential changes
- Credentials removed from authenticators
- Permission revocation events
Access Event Audit Trail
Access Control logs successful and failed access attempts with:
- Credential used (PIN, card ID, fingerprint, or web token identifier)
- Door accessed
- Timestamp
- Whether the access succeeded or why it failed
Credential Audit Trail
Changes to credentials are logged separately with sensitivity controls:
- Credential creation: logged with the initial value
- Credential reset: logged with a masked digest (never the actual new value) for security
- Credential deactivation: logged with the change reason
- Credential deletion: logged to show removal
PIN values and web secrets are never shown in regular logs.
Viewing Audit Logs
Access Control Audit Log
Shows all access events and administrative changes to the access control system.
- Admin users: Can view all audit entries system-wide
- Credential managers: Can view audit entries only for doors where they have permission
- Results are paginated to handle large deployments
Typical queries:
- "Show me all access to this specific door in the last week"
- "Show me all failed access attempts"
- "Show me all credential changes in the last month"
Credential Audit Log
Shows sensitive information about credential changes. This is restricted more strictly:
- Admins only can view this log
- Includes plaintext PIN values (for admin compliance and investigation)
- Includes masked digests of web secret resets (prevents exposure of new values)
This separation ensures that sensitive credential history is protected from non-admin users.
Best Practices
Role Assignment
- Assign Credential Manager to staff who manage daily access for their departments or buildings
- Reserve Admin for IT administrators and security officers only
- Use time-limited roles for temporary needs (contractors, consultants, seasonal staff)
- Regularly audit who has which roles to catch stale assignments
- Revoke roles immediately when staff leave roles or change departments
Permission Management
- Grant device-level permissions narrowly — only to the access points each person needs to manage
- Use facility-based permission scopes (e.g., "Building A manager", "Floor 2 manager") rather than giving everyone broad access
- Revoke permissions when staff change roles
- Test permission revocation to ensure it deactivates profiles correctly
Audit Trail Hygiene
- Review access logs weekly for unusual access patterns (access outside normal hours, multiple failed attempts)
- Investigate error entries to identify misconfigured authenticators or network issues
- Archive credential audit logs for compliance and retention
- Never share plaintext PINs or WEB secrets outside of privileged audit access
- Use audit logs for incident response — if a door is found compromised, check who had access and when
Where to Continue
| Goal | Page |
|---|---|
| Learn how credentials and access profiles work | Credentials and Profiles |
| Understand access points and door configuration | Access Points |
| See the core Access Control model and architecture | Overview |