{"id":9899,"date":"2026-11-01T09:35:23","date_gmt":"2026-11-01T08:35:23","guid":{"rendered":"https:\/\/blog.simons-voss.com\/uncategorised\/wie-zutrittskontrolle-funktioniert-vier-kernkomponenten-im-ueberblick\/"},"modified":"2026-10-28T12:34:44","modified_gmt":"2026-10-28T11:34:44","slug":"how-access-control-works-four-core-components","status":"publish","type":"post","link":"https:\/\/blog.simons-voss.com\/en\/technology\/how-access-control-works-four-core-components\/","title":{"rendered":"How Access Control Works: Four Core Components Explained"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.16″ global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row admin_label=”Zeile” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ admin_label=”Spalte” _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text ul_type=”square” admin_label=”Text” _builder_version=”4.27.0″ _module_preset=”default” text_font=”|300|||||||” text_text_color=”#6b717a” text_font_size=”22px” ul_font_size=”22px” ul_line_height=”5px” ol_font_size=”20px” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

Access control works through four core components, identification, authentication, authorisation and auditability, which together determine who is granted access, where, when and how, whether that’s entering an office or reaching a restricted area at an airport. <\/strong><\/p>\n

In an increasingly connected world, protecting buildings, rooms and sensitive areas against unauthorised access is essential, and modern access control systems achieve this reliably and efficiently while simplifying the management of complex locking systems. Each component plays a clearly defined role, and it’s only when all four work together that they provide comprehensive protection.<\/p>\n

<\/strong><\/p>\n

[\/et_pb_text][et_pb_image src=”https:\/\/blog.simons-voss.com\/wp-content\/uploads\/2023\/07\/4_TRANSPONDER_Tueroeffnung_gross_RGB-1500×847-1.jpg” alt=”B\u00fcrot\u00fcr wird mit SmartCard von SimonsVoss ge\u00f6ffnet” title_text=”Transponder T\u00fcr\u00f6ffnung” align=”center” admin_label=”Bild” _builder_version=”4.27.5″ _module_preset=”default” width=”80%” min_height=”80px” hover_enabled=”0″ border_color_all=”#d0040d” global_colors_info=”{}” theme_builder_area=”post_content” sticky_enabled=”0″][\/et_pb_image][et_pb_text ul_type=”square” admin_label=”Text” _builder_version=”4.27.0″ _module_preset=”default” text_font=”|300|||||||” text_text_color=”#6b717a” text_font_size=”22px” ul_font_size=”20px” ul_line_height=”1.7em” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

<\/span><\/p>\n

<\/span><\/p>\n

1. <\/span>Identification: Who Is Requesting Access?<\/h2>\n

<\/span><\/p>\n

A system can’t know who to grant access to if it doesn’t first know who’s at the door, so the first step in every access request is identifying the person or device requesting entry, establishing a unique identity before any further checks take place. Typical identification methods include RFID cards or transponders, PIN entry via a keypad, biometric characteristics such as fingerprints or facial recognition, and mobile identification via a smartphone app.<\/p>\n

Identification is the process by which a person presents their identity to the system, for example by presenting an electronic credential or entering a PIN.<\/p>\n

In short: identification is simply the system capturing who or what is asking to get in, before it checks whether that identity is genuine or permitted.<\/strong><\/p>\n

<\/strong><\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=”Zeile” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ admin_label=”Spalte” _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text ul_type=”square” ol_position=”outside” ol_item_indent=”20px” admin_label=”Text” _builder_version=”4.27.0″ _module_preset=”default” text_font=”|300|||||||” text_text_color=”#6b717a” text_font_size=”22px” ul_font_size=”20px” ul_line_height=”1.7em” ol_font_size=”20px” ol_line_height=”1.6em” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

<\/span><\/h2>\n

<\/span><\/h2>\n

<\/span><\/h2>\n

<\/span><\/h2>\n

<\/span><\/h2>\n

2. <\/span>Authentication: Is the Identity Genuine?<\/h2>\n

Once an identity has been presented, it needs verifying: does the claimed identity genuinely belong to the person at the access point? Authentication helps prevent identity misuse and protects against unauthorised access using stolen credentials.<\/p>\n

The three-factor model describes three fundamental ways of verifying a person’s identity, and common authentication methods can be assigned to one of these factors: knowledge, something only the authorised person knows, such as a PIN; possession, something only the authorised person has, such as a smart card; and inherence, something the authorised person is, such as a fingerprint. Combining multiple factors helps reduce the security risks associated with relying on a single authentication method, and two-factor authentication is now widely used in environments requiring enhanced security, such as data centres, laboratories and archives.<\/p>\n

In short: authentication confirms an identity is genuine using one or more of three factors, something you know, something you have, or something you are, with two-factor combinations used where security needs are higher.<\/strong><\/p>\n

<\/strong><\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ admin_label=”Sektion” _builder_version=”4.27.0″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_row admin_label=”Zeile” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ admin_label=”Spalte” _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_image src=”https:\/\/blog.simons-voss.com\/wp-content\/uploads\/2026\/01\/serverraum-mann.jpg” alt=”Mitarbeiter im Serverraum” title_text=”Mitarbeiter im Serverraum” align=”center” admin_label=”Bild” _builder_version=”4.27.0″ _module_preset=”default” width=”80%” min_height=”80px” border_color_all=”#d0040d” global_colors_info=”{}” theme_builder_area=”post_content”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=”Zeile” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ admin_label=”Spalte” _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text ul_type=”square” ol_position=”outside” ol_item_indent=”20px” admin_label=”Text” _builder_version=”4.27.0″ _module_preset=”default” text_font=”|300|||||||” text_text_color=”#6b717a” text_font_size=”22px” ul_font_size=”20px” ul_line_height=”1.7em” ol_font_size=”20px” ol_line_height=”1.6em” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

\u00a0<\/span><\/h2>\n

<\/span><\/h2>\n

<\/span><\/h2>\n

<\/span><\/h2>\n

<\/span><\/h2>\n

3.\u00a0<\/span>Authorisation: What Is the Person Allowed to Access?<\/h2>\n

While identification and authentication establish who’s at the access point, authorisation answers a different question: what is this person permitted to access? The system checks whether the identified and authenticated individual has permission to enter the requested area and under what conditions. Typical authorisation criteria include role-based permissions, such as allowing IT employees to access server rooms, time-based permissions, such as restricting access to weekdays between 8am and 6pm, and location-based permissions, such as allowing access to one building but not another.<\/p>\n

Modern access management systems can assign permissions dynamically rather than relying on static master keys or fixed access permissions, responding to changing user requirements in real time. This brings clear benefits: rapid changes when employees join, leave or move between departments, temporary access permissions for external contractors, multi-site management via cloud platforms, and reduced security risks through the principle of limited access.<\/p>\n

Authentication verifies that someone genuinely is who they claim to be, while authorisation determines what that authenticated person is permitted to do, which in an access control environment means which doors or areas they’re allowed to access.<\/p>\n

In short: authorisation decides what an already-verified person can do, by role, time or location, and modern systems can update these permissions instantly rather than relying on fixed keys.<\/strong><\/p>\n

<\/strong><\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=”Zeile” _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}” theme_builder_area=”post_content”][et_pb_column type=”4_4″ admin_label=”Spalte” _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||” theme_builder_area=”post_content”][et_pb_text ul_type=”square” ol_position=”outside” ol_item_indent=”20px” admin_label=”Text” _builder_version=”4.27.0″ _module_preset=”default” text_font=”|300|||||||” text_text_color=”#6b717a” text_font_size=”22px” ul_font_size=”20px” ul_line_height=”1.7em” ol_font_size=”20px” ol_line_height=”1.6em” global_colors_info=”{}” theme_builder_area=”post_content”]<\/p>\n

\u00a0<\/span><\/h2>\n

4. <\/span>Auditability: Who Accessed What, Where and When?<\/h2>\n

Effective access control doesn’t end when the door opens. Modern systems can log access attempts, whether successful or denied, creating an audit trail that supports security management, audits and forensic investigations. What’s typically logged includes the time and location of the access attempt, the credential used, whether the request was granted or denied, and additional authentication events, such as the use of two-factor authentication.<\/p>\n

In short: auditability creates the access record itself, but that record is personal data under UK law, so it needs proper protection, controlled access and a justified retention period.<\/strong><\/p>\n