Five Things Worth Asking at the Door

Possession alone does not necessarily equal trust. It never has.

A credential that scans successfully at the door and a person who is allowed through that door are not always the same thing.

Most of the time, they align. Someone taps, the system recognizes a valid credential, the door unlocks and nothing about that transaction deserves a second thought. But the access control system isn’t necessarily confirming that the right person is standing there. It’s confirming that a credential it recognizes is present. Those are different claims, and there are more interesting (and important) questions to ask.

In my conversations with security leaders, I’ve noticed the focus increasingly shifting from whether a credential is valid to how much confidence the organization has in the overall access decision. It’s becoming less about credential recognition and more about understanding the context of its use. At its core, that’s a conversation about trusted access and how organizations establish confidence in every access interaction.

When you look at trust through that lens, five questions start to emerge:

• Do we trust this credential?
• On this device?
• For this person?
• At this access point?
• At this time?

Let’s break down each of these.

1. This Credential: What Can It Actually Prove?

Every credential makes a claim. What varies is how much that claim is worth.

Legacy credentials hand over their data to any reader that asks. More modern credentials authenticate with the reader first, so that each can prove to the other it’s genuine before the data moves anywhere.

Both types of credentials are widely used — even within the same company — because access control environments tend to accumulate. They can vary site to site or be compiled over time. Knowing which credential technologies are in use and where makes confidence in an access decision possible.

2. This Device: What Is the Credential Living On?

A credential has to live somewhere, and where it lives changes quite a bit about it.

A card is a container that works identically in any hand. It has no way to distinguish its owner from anyone else, and no way to tell you it’s somewhere it shouldn’t be. That isn’t a flaw in the card. It’s simply the limit of what a piece of plastic (or bamboo) can do.

A credential on a phone sits behind whatever protects the phone — a face, a fingerprint, a passcode — and it can be managed after the fact. If the device is lost, the credential can be removed without anyone tracking it down.

3. This Person: How Do You Know It’s Them?

No credential technology proves identity on its own.

What organizations can do is add factors. Something you have, plus something you know. Something you have, plus something you are. Sometimes all three.

Biometrics come with a second decision: where the biometric data lives. A biometric captured and matched on a personal device stays on that device. One enrolled into a central system becomes data that the organization holds, protects and answers for. Both have their place, though the privacy and governance work they require is very different.

4. This Door: What’s the Right Level of Security?

Access control strategy tends to get set organization-wide. Risk doesn’t work that way.

One thing I frequently hear from security leaders is that the challenge isn’t deciding which technology is most secure. It’s deciding where additional confidence in an access decision actually adds value, and where it simply adds friction.

Consider a turnstile lobby at a large financial institution, where several thousand people arrive within the same hour. Getting people through quickly is the main challenge, and either mobile access or facial recognition can solve it. Now put that same solution on a janitor’s closet on the fourth floor. Probably overkill.

The principle extends beyond the door itself. Whether access is being granted through a turnstile, an elevator or a traditional door, the question remains the same: what level of confidence is required for this particular access decision?

Doors in a building are hiding any number of things: server rooms, labs, loading docks, regulated access areas, spaces a contractor needs for six weeks and not a day longer. Each one has a different answer to how many of the five questions are worth asking, and how much friction is worth accepting to get them answered.

5. This Time: Is Everything Still Current?

A credential issued two years ago reflects what was true two years ago.

People change roles, finish contracts, move sites and leave. The credential doesn’t know. It works exactly as well on someone’s last day as it did on their first, and it keeps working until somebody does something about it.

Most organizations believe they handle this well. Research published in June 2026 by HID and the FIDO Alliance found that 94% of organizations say they can revoke all physical and digital access within 24 hours of an employee leaving. And yet 35% reported delays or failures doing exactly that in the past two years.

The gap isn’t carelessness. Revocation depends on someone knowing there is something to revoke, and on the process reaching every system that credential touches. Which is why the fifth question is less about technology than about whether the door is connected to how the organization tracks who works there.

Spoiler: You Don’t Need Five Answers at Every Door

Some doors are fine with one. The point of breaking the question into five isn’t to raise the bar everywhere. It’s to make the bar a decision rather than an inheritance.

A useful exercise: pick the area of your organization where the consequences of the wrong person walking in would be most serious. Then count how many of the five questions your current setup can answer at that door. Not how many it could answer in principle. How many does it answer today?

Whatever that is, it’s a starting point. Some organizations find they’re already answering more than they thought, but the gaps sit in different places than they assumed. Fortunately, with advances in modern credentials and readers, there are more ways to close those gaps than ever before.