How Access Control Works: Four Core Components Explained

Access control works through four core components, identification, authentication, authorisation and auditability, which together determine who is granted access, where, when and how, whether that’s entering an office or reaching a restricted area at an airport.

In an increasingly connected world, protecting buildings, rooms and sensitive areas against unauthorised access is essential, and modern access control systems achieve this reliably and efficiently while simplifying the management of complex locking systems. Each component plays a clearly defined role, and it’s only when all four work together that they provide comprehensive protection.

1. Identification: Who Is Requesting Access?

A system can’t know who to grant access to if it doesn’t first know who’s at the door, so the first step in every access request is identifying the person or device requesting entry, establishing a unique identity before any further checks take place. Typical identification methods include RFID cards or transponders, PIN entry via a keypad, biometric characteristics such as fingerprints or facial recognition, and mobile identification via a smartphone app.

Identification is the process by which a person presents their identity to the system, for example by presenting an electronic credential or entering a PIN.

In short: identification is simply the system capturing who or what is asking to get in, before it checks whether that identity is genuine or permitted.

2. Authentication: Is the Identity Genuine?

Once an identity has been presented, it needs verifying: does the claimed identity genuinely belong to the person at the access point? Authentication helps prevent identity misuse and protects against unauthorised access using stolen credentials.

The three-factor model describes three fundamental ways of verifying a person’s identity, and common authentication methods can be assigned to one of these factors: knowledge, something only the authorised person knows, such as a PIN; possession, something only the authorised person has, such as a smart card; and inherence, something the authorised person is, such as a fingerprint. Combining multiple factors helps reduce the security risks associated with relying on a single authentication method, and two-factor authentication is now widely used in environments requiring enhanced security, such as data centres, laboratories and archives.

In short: authentication confirms an identity is genuine using one or more of three factors, something you know, something you have, or something you are, with two-factor combinations used where security needs are higher.

3. Authorisation: What Is the Person Allowed to Access?

While identification and authentication establish who’s at the access point, authorisation answers a different question: what is this person permitted to access? The system checks whether the identified and authenticated individual has permission to enter the requested area and under what conditions. Typical authorisation criteria include role-based permissions, such as allowing IT employees to access server rooms, time-based permissions, such as restricting access to weekdays between 8am and 6pm, and location-based permissions, such as allowing access to one building but not another.

Modern access management systems can assign permissions dynamically rather than relying on static master keys or fixed access permissions, responding to changing user requirements in real time. This brings clear benefits: rapid changes when employees join, leave or move between departments, temporary access permissions for external contractors, multi-site management via cloud platforms, and reduced security risks through the principle of limited access.

Authentication verifies that someone genuinely is who they claim to be, while authorisation determines what that authenticated person is permitted to do, which in an access control environment means which doors or areas they’re allowed to access.

In short: authorisation decides what an already-verified person can do, by role, time or location, and modern systems can update these permissions instantly rather than relying on fixed keys.

4. Auditability: Who Accessed What, Where and When?

Effective access control doesn’t end when the door opens. Modern systems can log access attempts, whether successful or denied, creating an audit trail that supports security management, audits and forensic investigations. What’s typically logged includes the time and location of the access attempt, the credential used, whether the request was granted or denied, and additional authentication events, such as the use of two-factor authentication.

In short: auditability creates the access record itself, but that record is personal data under UK law, so it needs proper protection, controlled access and a justified retention period.

Don’t Overlook Data Protection

Where access logs relate to identifiable individuals, their collection, use and retention must comply with applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018. Organisations should ensure access data is appropriately protected, that access to it is controlled, and that retention periods are justified, and ICO guidance emphasises the importance of appropriate access controls and monitoring to prevent unauthorised access to personal information.

How the Four Components Work Together

The four core functions of an access control system only deliver their full value together, with each stage building reliably on the one before it to create a secure and auditable access process. A typical access request works like this: identification happens when a person presents a credential, for example holding an access card up to the reader; authentication happens when the system reads the credential and verifies the presented identity; authorisation happens when the system determines whether the person can access the requested area at that particular time; and auditability happens when the access event is logged in the background, including the date, time and outcome.

With System 3060, SimonsVoss provides a comprehensive electronic locking solution incorporating components such as digital locking cylinders and electronic door furniture, credentials including transponders and cards, and the associated management software. Using the SmartIntego solution, SimonsVoss components can also be seamlessly integrated into existing building management systems. The objective throughout is integrated access control: enhancing building security through automated verification, enabling flexible management of permissions as requirements change, supporting compliance with relevant requirements and policies, and enabling a rapid response to security incidents.

In short: the four components form a chain, identify, authenticate, authorise, log, and a system like System 3060 handles all four together rather than as separate tools.

Integrated Access Control in Smart Buildings

In modern building management systems, access control can be integrated with functions such as CCTV, alarm management and room automation. This creates new opportunities to improve operational efficiency while strengthening risk prevention and building security.

In short: access control increasingly works alongside CCTV and alarm systems rather than as a standalone function, giving a fuller picture of building security.

Want to learn more about intelligent access control and digital locking systems? Speak to our experts to find out more.

FAQ