Access control that keeps up with move-ins and move-outs

A tenant on the sixth floor gave notice in June and moved out on the thirty-first of July. Their accounting system knows. Their suite is being marketed. And on the fourteenth of September, one of their former employees taps a badge at the turnstile at 7:40 in the morning and the door opens.

Nobody did anything wrong. The move-out was handled by leasing, the badge was issued by security, and the two facts never met. That gap is what building access control software is supposed to close, and in most multi-tenant buildings it is still closed by a person with a spreadsheet.

Access is a lease question that gets answered by a security system

Who belongs in suite 604 is decided by a lease. Who gets through the door to suite 604 is decided by a credential database. Those two live in different systems, are maintained by different teams, and drift apart the moment anything changes.

Every one of these is a drift event: a new hire, a departure, a suite expansion, a sublease, a contractor on a six-week job, a tenant taking swing space for a refit, a move-out. In a building with forty tenants there are several a week, and each one is a small manual reconciliation somebody has to remember.

The move-out is the one that matters

New hires get fixed quickly because someone complains. A new employee whose badge does not work will be at the front desk within the hour, and the problem announces itself.

Departures are silent. Nobody reports a credential that still works. It sits there until an audit, an incident, or a curious former employee, and the building has no way to know it exists because nothing in the system says it should have died.

Tenant self-service, with a boundary

The instinct is to centralise: property management owns the credential list, tenants submit requests, the desk processes them. This is safe, slow, and it makes the property manager the bottleneck for every hire and departure in the building.

The better shape is delegation with a boundary. A tenant administrator manages their own people, inside their own suite and the common areas their lease grants, without being able to grant access to anything else. The building keeps the perimeter, the amenity floors and anything shared. The tenant keeps their own roster, which is the only list they can maintain accurately.

That boundary is the whole design. Get it wrong in the permissive direction and a tenant can badge into a mechanical room. Get it wrong in the restrictive direction and you are back to the property manager processing badge requests on a Friday afternoon.

What good access control looks like

• Lease dates drive credential dates. A term that ends on the thirty-first should expire access on the thirty-first without anyone deciding to do it.
• Tenants manage their own roster. Inside their suite and their granted common areas, with the building keeping everything shared.
• Credentials expire by default. Contractors and visitors get a time window instead of an open-ended card that has to be collected.
• One audit view across doors and systems. Who has access to what, exportable, without joining three exports by hand.
• Vendor access checks compliance. A contractor whose certificate of insurance has lapsed should not receive a working credential that morning.

Mobile credentials change the operational maths

Plastic has a physical lifecycle: printed, handed over, lost, replaced, occasionally returned. Every step is somebody's time at a desk.

A wallet credential is issued and revoked remotely, which removes the collection problem entirely and makes expiry practical instead of theoretical. It also survives the most common failure in any building, which is a person who forgot the thing they need, because almost nobody arrives without their phone.

Two cautions worth saying out loud. Not every reader in an older building supports mobile credentials, so this is usually a phased upgrade instead of a switch. And a plan for the person whose phone is dead is still required, which usually means the front desk can issue a temporary pass with a short window.

After hours is a different building

Between six in the evening and six in the morning the same doors mean something else. The lobby is unstaffed, the lifts may be locked to floors, and the people in the building are a much smaller and less predictable set.

Access rules should reflect that instead of treating the day as uniform. A tenant's general staff may not need weekend entry. Their overnight IT contractor does, for four floors, for three weeks. A cleaning crew needs the whole building at eleven at night and none of it at eleven in the morning.

Buildings that manage this well express it as schedules attached to groups instead of exceptions granted to individuals, because individual exceptions are never reviewed and never expire.

The tailgating conversation

Every credential system is defeated by a person holding a door open for someone carrying a box, and no software fixes that. It is worth being honest about the limit instead of selling around it.

What the system can do is narrow the consequences. If credentials are current, expiries are enforced and the log is complete, then the building's exposure is one uncontrolled entry instead of an unknown number of live cards belonging to people who left. That is a meaningful difference on the day something happens, and it is achievable. Eliminating tailgating in a lobby with turnstiles and a hundred people at 8:50 is not.

Do not rip out what works

Most multi-tenant buildings already own an access control system that functions, with readers, panels and wiring that were expensive and are fine. The failure is almost never the hardware. It is that nothing connects the credential database to the lease data, so the reconciliation is manual.

Adding a layer that reads lease terms and writes credential changes into the existing system solves the actual problem for a fraction of a replacement, and it does not ask a building to re-badge two thousand people to fix an administrative gap. Replace hardware when it fails or when it cannot do something you need. Do not replace it to fix a data problem.

The audit you should be able to run today

Here is a test that takes an afternoon and tells you where you stand. Pull every active credential. Join it against current tenants and their suites. Count the ones that belong to a tenant whose lease has ended, a person who left, or a contractor whose job closed months ago.

Almost every building that runs this for the first time finds more than it expected. That number says nothing bad about the security team. It is the predictable result of two systems that were never connected.

Where BuildingHub fits

Security Hub manages credentials and real-time keycard permissions on top of the access control already installed, integrating with Genea, LenelS2 and HID instead of replacing them. Because lease records live in Leasing Hub in the same platform, a term that ends can expire the access it granted, and vendor credentials can be checked against the certificate tracking in Operations Hub before anyone reaches a lift. Related: the front desk problem.