Installing a better lock or adding facial recognition is common advice for improving access control. Neither fixes the harder problem: a door can open correctly while nobody can reliably establish who entered, who approved it or whether that authority was still current.

Integrity access control means making those connections dependable. For an Australian site manager, the practical question isn't whether a credential works. It's whether the physical pass, contractor record and administrator activity can be reconciled into an attributable trail without collecting unnecessary personal information.

Integrity Access Control in One Control Model

Start with a working test that applies equally to doors, lifts, gatehouses and administrator accounts:

An access decision has integrity when a named person, a current authority and a recorded event can be lined up afterwards.

A successful swipe proves that the reader accepted a credential. It doesn't, by itself, prove that the authorised person used it or that their permission still matched the work.

What integrity access control must prove

Read the rows in order. Identity proofing connects the credential to a person, rather than a team sharing a badge. Least privilege keeps a delivery driver's loading-bay permission separate from plant-room access.

Time and location restrictions narrow that permission further. A contractor's card should match their approved site and work window, not remain usable everywhere because the initial identity check was satisfactory.

Lifecycle management covers employment changes, transfers and subcontractor induction expiry. Privileged administration covers the people who can change those rules, while audit and response preserve evidence of approvals, refused entry and withdrawn authority, not just successful swipes.

Layer protection without retaining everything

Under Australian Privacy Principle 11, covered organisations must take reasonable steps to protect personal information against misuse, interference, loss, unauthorised access, modification and disclosure, as set out in the OAIC's Australian Privacy Principles. Layered technical and organisational safeguards are the practical response: a badge or PIN alone leaves a lost card or shared code as a single point of failure.

For facilities teams coordinating employers and contractors, Facility Management Insights' resource on managing employee and vendor access provides useful context for treating both groups within the same access process.

Mark the first table row your site cannot currently evidence. Keep provisioning, approval, review and revocation records for a defined purpose and retention period, then destroy or de-identify personal information when it's no longer required.

Why Valid Credentials Still Break Integrity

Valid-account abuse accounted for 16% of initial-access techniques in the critical-infrastructure incidents described in the Australian Signals Directorate's 2025–26 critical-infrastructure threat reporting. The same reporting says ACSC responded to 154 incidents involving critical-infrastructure entities, representing 10% of all incidents handled, approximately 7% lower than the previous year; phishing accounted for 36%, while the reported sector shares included financial and insurance services at 30%, public administration and safety at 21%, and electricity, gas, water and waste services at 17%.

Those figures concern critical infrastructure, not a measured incident rate for ordinary commercial buildings. Their operational relevance is the way an attacker can use apparently legitimate access.

The graphic highlights the difference between possessing a credential and using it with authority.

The copied-key problem

A copied house key still turns the lock. The lock hasn't failed mechanically, but the household can't identify the person who entered from that action alone.

Consider a Brisbane logistics gate. A driver presents a genuine contractor card borrowed from someone else, and the gate opens because the card remains active. The recorded cardholder and the person entering are now different people.

At a Melbourne office tower, the equivalent problem might be a facilities login used by a former subcontractor. If that account can remotely release doors, a digital permissions failure becomes a physical entry problem.

A Perth plant-room badge creates another version: the right person holds the card, but their maintenance assignment has ended. Identity can be correct while authority is wrong.

Review the person across both systems

The corrective action isn't to distrust every successful access event. It's to check whether permissions, authentication and records support the person's actual task.

• Limit the scope: Restrict doors, administrative functions and sites to the approved role.
• Strengthen authentication: Use multifactor authentication for administrative and remote access where supported.
• Review connected permissions: Compare physical credentials with contractor status and digital accounts.
• Prepare suspension: Give the duty manager a clear route to disable suspect access and escalate the event.

A workable visitor management policy should also explain what staff do when a pass is valid but the appointment, sponsor or permitted destination cannot be confirmed.

This video offers an additional prompt for discussing access-control decisions with site personnel.

Ask a direct operational question: which cards and accounts would still work if their holder had left yesterday? Investigate the answer across facilities, security and IT rather than accepting separate assurances from each team.

Australian Rules Behind Stronger Entry Control

Australian critical-infrastructure rules treat unauthorised access to, interference with or control of an asset as a physical security hazard where it could compromise the asset's proper function or cause significant damage, under the Critical Infrastructure Risk Management Program Rules.

For responsible entities within scope, the risk-management program must address unsupervised access to critical components, credential and privileged-access misuse, people who aren't critical workers, and workers moving into and out of relevant roles. That's a broader obligation than installing readers and distributing passes.

The diagram summarises the connection between entry, interference and operational consequences.

Turn the hazard definition into a zone list

These requirements don't automatically apply to every commercial property. However, the method offers a useful benchmark for industrial and commercial managers in Sydney, Melbourne and surrounding centres.

Begin with the locations where interference would matter most. Consider switchrooms, control rooms, communications cupboards, chemical stores and security-control workstations, then identify the operational owner of each area.

For each proposed sensitive zone, document:

• Permitted roles: Name the jobs that require entry, rather than granting access to an entire contractor organisation.
• Approval authority: Identify who can approve access and the work that justifies it.
• Escort conditions: Specify when a visitor must remain accompanied.
• Monitoring responsibility: Assign who receives an alarm and checks the circumstances.

A gatehouse or concierge officer can confirm identity, appointment details and induction status before issuing a temporary pass. The electronic system should then enforce the approved destination rather than leave the officer's verbal instruction as the only restriction.

For critical components within the rules' scope, access restrictions, accompanied visitors, surveillance and maintained alarms must operate together. A camera recording an empty control room is not the same as someone being responsible for responding to its alerts.

Control who can rewrite the permissions

The administrator requires separate scrutiny. An installer who can create badges or rewrite door schedules can change the boundary everyone else relies on.

Australian Government guidance on privileged-access protections recommends dedicated privileged accounts, separation from ordinary operating environments, and central logging and analysis of privileged access and account-management activity. Apply that discipline to installers, monitoring operators and facilities administrators.

Require independent change approval, time-bound access where feasible, and logs identifying who created a credential or expanded a zone. Don't use shared master credentials for routine work or browse email from a session that can administer the access platform.

Keep these responsibilities in your regulatory compliance documentation. Finish the walk-through with a short list of rooms where an escort is preferable to standing access, and identify who can authorise exceptions.

Entry Checks for Construction Retail and Events

Different sites need different entry decisions. A construction permit, an event wristband and a tenancy authorisation aren't interchangeable evidence, even when each results in a person receiving a pass.

For critical infrastructure, the CISC guidance for the Critical Infrastructure Risk Management Program says responsible entities must identify critical workers and assess their suitability before permitting access to critical components. Its distinction between identity and suitability is useful elsewhere: knowing someone's name doesn't establish their entitlement to every room.

Integrity checks by site type

The table describes practical operating controls, not a claim that every setting has the same statutory obligations.

Apply the restriction at the actual doorway

Construction Security: Say a subcontractor arrives at a Sydney or Melbourne project with a current induction. Gatehouse Security should still confirm the work permit and destination before admitting them to a restricted work area. A practical construction site access-control procedure should separate permission to enter the site from permission to undertake particular work.

Retail Security and Shopping Centre Security: A cleaner may need a service corridor after trading hours without needing the cash office. If an unusual cash-office door event occurs, the supervisor should compare the roster, approved access and reason for entry rather than assume every back-of-house worker has the same permissions.

Event Security: A general-admission wristband mustn't become a backstage pass through familiarity or crowd pressure. If someone transfers a band, entry staff need a way to check the relevant authorisation; an alcohol-related incident may also require reassessment of that person's access to a controlled area.

Concierge Security: A tower contractor's floor rights should follow the authorised work order. When the job ends, the concierge needs a completion notification, not an assumption that the building manager will notice during a later audit.

Mobile Patrols: At a Brisbane or Perth property, a patrol officer responding to an open-door alert should check the existing access list, visitor record and available CCTV or patrol notes. Attendance at the site doesn't give the officer authority to approve an otherwise unauthorised visitor.

Practical rule: A person can be correctly admitted to the property and still be incorrectly admitted to a room.

Pick the row closest to your operation and write down the permission that's currently too broad. Define the narrower destination, the person who can approve it and the event that should trigger review.

When Collecting More Identity Data Backfires

Facial recognition and continuous video analytics don't automatically improve integrity. If staff can't connect a biometric enrolment to current authority, collecting a more sensitive identifier may only add another record to protect.

Organisations covered by Australian privacy law must handle personal information consistently with the Australian Privacy Principles, as explained by the Office of the Australian Information Commissioner. Vendor arrangements, including offshore cloud processing, need scrutiny rather than an assumption that the supplier has resolved privacy responsibilities.

The comparison below challenges the idea that greater collection necessarily creates stronger authorisation.

Lower-intrusion options against biometric enrolment

These retention rules are design recommendations, not universal statutory periods.

A staffed identity check can establish that a visitor matches an appointment without keeping a copy of their identity document. A time-limited credential can then restrict entry to the approved visit.

Anti-passback can help identify repeated credential use inconsistent with the expected entry sequence, but it doesn't independently prove identity. Likewise, event-linked CCTV can support an investigation without justifying indefinite retention of everyone's movements.

Make necessity and deletion demonstrable

Before enrolling facial templates, record the problem that less intrusive controls cannot adequately address. Include false matches, accessibility and a workable alternative for people who cannot or should not be enrolled.

• Visitors and children: Avoid treating casual presence in a shopping centre as sufficient reason for biometric collection.
• Vendor administrators: Identify who can view, export or delete templates and associated records.
• Overseas processing: Establish storage locations, subcontractor access and applicable contractual controls.
• Deletion: Test removal from operational systems and establish how backups and retained incident evidence are handled.

A landlord, employer, strata body, security operator and technology supplier may each touch the same record. Each needs a defined reason and access boundary, reflected in documented data privacy and security measures.

The decision should end with yes or no on proportionality, not enthusiasm for the technology. Can the site prove authorisation using less personal information, and can it reliably remove what it no longer needs?

Licence and Engagement Checks Before Access Is Trusted

A working pass does not prove that its holder is authorised for a particular post. Before deployment, the site manager and employer should establish who is legally eligible, what duties are assigned, and where the engagement's authority ends.

Complete the checks before deployment

1. Confirm the appropriate licence. The Fair Work Commission's Security Services Industry Award 2020 requires the employer to ensure the employee holds the appropriate licence for their classification or work. It also says a missing licence does not remove award entitlements, while allowing a stand-down without pay for up to two weeks, or another agreed period, while the issue is resolved. Verify the licence before the shift begins.

2. Match the licence to the post. Crowd-control duties at an event differ from static security guarding at a gatehouse. Record the assigned tasks, such as visitor screening, patrols and control-room access, then check that the licence covers the work under the relevant state or territory requirements.

3. Track expiry, suspension and relief coverage. Record the verification outcome and relevant dates in a controlled roster or compliance register. Arrange suitable relief so a licensing issue does not leave an entrance unattended or prompt a supervisor to assign someone who is not qualified for the post.

4. End credentials when authority ends. Document the process for revoking access when a person leaves or an engagement expires. Include physical passes, remote access, key registers and incident-reporting systems. Name who confirms that each credential has been withdrawn.

5. Set the engagement boundaries. Record who can approve an exception, authorise a remote door release or receive sensitive incident information. Give officers clear instructions on escalation, emergency arrangements and the limits of their authority. A vague instruction can leave a guard, contractor and site manager working from different assumptions.

When engaging private security contractors, provide an accurate scope of work and safe, unobstructed access to the premises. The access decision is only as clear as the instructions and conditions the property manager and occupier provide.

Leave a usable audit trail

Before accepting the arrangement, ask the site supervisor to identify:

• Sensitive zones: Which rooms, systems and records need restricted access.
• Authorised people: Which roles and named approvals support entry.
• Permission endings: How access is withdrawn after a role change or departure.
• Reconstruction evidence: Which log, approval and incident record show what happened.

If staff can describe the intended control but cannot produce its supporting record, arrange a documented risk walk-through.

At ABCO Security Services Australia, security personnel are fully licensed and insured, and the company complies with security and OH&S regulations. Record applicable licence and insurance details in the engagement documentation so the contracting parties have a clear basis for their responsibilities.

The client remains solely responsible for maintaining insurance coverage for their property. Security services do not guarantee full protection against theft or damage, and an access-control plan is not a substitute for property insurance.

ABCO Security Services Australia offers a free on-site risk assessment and customised security plans shaped to the customer's environment, industry and budget. For sites in Melbourne, Sydney, Brisbane, Perth, Adelaide and across Australia, visit ABCO Security Services Australia to discuss your location and arrange a walk-through of entry permissions, contractor controls and the records that support each access decision.