Access Control in Guwahati.

The credential choice sets the security floor. Legacy proximity credentials are convenient and trivially cloneable; encrypted smart credentials resist copying; mobile credentials remove the card entirely and introduce a dependency on the user's phone and on an enrolment process; biometrics remove the credential but raise a personal-data obligation that has to be answered before, not after, deployment. A site that mixes visitor cards, staff credentials and contractor access needs that mix designed rather than accumulated.

Door hardware is the decision that is hardest to change afterwards, because it is mechanical. Whether a door fails secure or fails safe on power loss, whether it uses a magnetic lock or an electric strike, whether it needs a request-to-exit device, a door-position sensor or both — all of that is determined by the door's fire and egress role and by what the leaf and frame can physically accept. Retrofitting an electric lock into an existing frame is frequently the constraint that decides the design.

Topology is the third choice: controllers on the network with local decision-making, or a centralised architecture that stops working when the link does. On a multi-building campus with variable connectivity, controllers that hold their own credential database and decide locally are the difference between a network fault being an inconvenience and being a lockout.

The governing rule is that free egress cannot be conditional on a credential, a network, a server or a power supply. A person inside a building must be able to leave by an escape route without needing anything to work. That single principle determines lock type, request-to-exit provision, emergency-release hardware and the fail state of every door on an escape route — and it takes precedence over every security preference on the project.

The fire interface is where that principle becomes wiring. Doors on escape routes release on a fire alarm condition, and that release is a hard interface from the fire system, not a software instruction from the access-control server. It has to survive the server being off. At the same time, certain doors may be required to remain closed for compartmentation, and the two requirements have to be reconciled door by door with the fire strategy — which is why the door schedule is a joint document rather than a security deliverable.

Access records identify individuals and their movements, which makes them personal data with a retention limit, a defined viewing authority and an export procedure. Where biometrics are used, the obligation is heavier and the enrolment consent, storage method and deletion process should be settled in the design phase.

The door schedule is the central coordination artefact of this discipline and it belongs to nobody by default, which is why it is so often missing. It must carry, per door: the fire rating, the escape-route role, the leaf and frame construction, the hardware set, the lock type and fail state, the reader side, whether egress is free or controlled, and the interlocks. Produced jointly by the architect, the fire consultant, the door supplier and the systems integrator, it makes the whole discipline buildable. Produced by one party alone, it guarantees a variation.

Cable routes to door heads are the second item and they are an architectural detail as much as an electrical one. Getting power and data into a glazed door head, a frameless assembly or a heritage frame requires the route to be designed before the assembly is manufactured. After manufacture, the options are surface containment or nothing.

The third is the enrolment and administration process. Somebody has to issue credentials, revoke them when people leave, authorise visitors and manage contractor access, and that person needs a workflow rather than a screen. Where the client has an HR or visitor system, the integration point and the direction of data flow are agreed at design stage.

Persistently damp air degrades reader electronics and lock mechanisms at external and semi-external doors — gates, service entrances, doors onto open corridors and stair cores that are open to outside air. Devices selected for an interior assumption and installed at a semi-exposed door will fail early, and the failure presents as intermittent read failures long before it presents as a dead device.

Power interruption exposes any door whose fail state was never actually decided. A magnetic lock on a mains supply releases when the supply goes, which is correct for egress and may be entirely wrong for a store room. A fail-secure electric strike is a different case and is frequently correct: where the leaf carries lever or panic hardware giving mechanical free egress from the inside, the strike controls the entry side only and escape never depends on it. It becomes a life-safety defect precisely when egress depends on the strike releasing electrically — which is why the door schedule has to record how egress is achieved on each door, not merely which lock is fitted. Grid instability here means these states are exercised regularly rather than theoretically, so an untested fail state becomes an observed problem quickly.

Doors themselves are the most common source of nuisance faults. Timber leaves move with humidity, closers fall out of adjustment, and a door that no longer seats reliably produces door-forced and door-held alarms that operators learn to ignore. At that point the alarm stream is decoration.

Tailgating defeats the best credential system ever specified, and it is a design and behaviour problem rather than a technology one — solved, where it must be solved, with the right physical arrangement at the entry point and a policy people understand, not by a more expensive reader.

The most consequential organisational failure is credential lifecycle: leavers whose cards were never revoked and contractors whose temporary access never expired. A system without a review routine accumulates valid credentials belonging to people who should not have them.

Every door tested against its schedule entry, including the fail state, physically proven by removing power rather than by inspecting a drawing. Free egress verified on every escape-route door. The fire-release interface tested from the fire panel with the fire contractor present, and demonstrated to work with the access-control server deliberately switched off — because that is the condition it exists for.

Controller offline behaviour tested by disconnecting the link and confirming that local decisions still happen and that events buffer and later reconcile. Credential enrolment, revocation and visitor issue walked through with the people who will do it, using the actual workflow rather than a demonstration.

Handover carries the as-built door schedule, controller and reader locations, the configuration backup, the data-retention and access policy, and a signed training record. The AMC then states the physical inspection cadence for door hardware — which is where most faults originate — the credential-review routine, and the firmware position. A door that no longer closes properly is an access-control failure regardless of how well the electronics work.