Access control is the mechanism that decides who may do what to a resource, when, and under what conditions, after their identity has been verified.
Consider one scenario. A contractor’s engagement ended three months ago. Nobody collected the badge, nobody disabled the email account, and both still work: the badge opens the server room door, the inbox still receives client files.
Situations like this stay invisible until something happens. Then the question changes: who has been able to walk in all this time?
The resource can be a building door, a server room, a shared drive file, or a customer account in your portal.
What Is Access Control?
The shortest version: access control is a permission decision system. Every badge tap, login, and request to open a file is a small decision that runs fast and usually goes unnoticed.
Those decisions determine how much damage one stolen credential can do. The 2022 edition of IBM’s Cost of a Data Breach Report counted 19 percent of breaches involving compromised credentials.
Customer sign-ins run the same principle under the name CIAM (Customer Identity and Access Management). The parties differ: employees and partners on one side, customers on the other.
Physical vs Logical Access Control: What’s the Difference?
Physical controls guard doors and buildings; logical controls guard systems and files. They usually live in separate articles, even though the logic is one:
| Aspect | Physical control | Logical control |
|---|---|---|
| What it protects | Doors, rooms, buildings, parking | Files, applications, databases, networks |
| Typical credentials | Badges, cards, fingerprints, faces | Passwords, OTP codes, tokens, certificates |
| Typical threats | A card lent out, a stranger tailgating in | Hijacked accounts, leaked credentials, reused passwords |
| Who manages it | Facility or general affairs | IT team |
They meet at real points: a server room has a physical door because its contents are digital. One credential can open both worlds, like a badge that doubles as VPN access, and in a hybrid office the “may enter” decision no longer splits between building and system.
Authentication vs Authorization: What’s the Difference?
Authentication verifies who you are; authorization decides what you may do afterward. Identification answers “who are you”: a badge is presented or a username typed. Authentication checks that claim against evidence: a password, a PIN, a fingerprint, or a one-time code. Authorization closes the sequence: yes to the third floor, no to the payroll folder.
The analogy is the lobby guard: he asks your purpose, checks your ID, then decides where you may go. If he stops at the check, everyone who proved their identity can go anywhere.
How Access Control Works
Access control runs through five steps in sequence, nearly always the same at a door and in a system: identification, authentication, authorization, execution, and logging:
- Identification. The person presents an identity: a badge is tapped on a reader, or a username is typed into a login page.
- Authentication. The system checks the evidence: the reader scans the badge chip at the door; in the system, the password is matched and multifactor authentication (MFA) asks for a second code.
- Authorization. The system compares the identity against policy in force. A finance employee may enter specific doors from 8 a.m. to 6 p.m., and specific folders in the system only.
- Execution. The door opens or the file opens, according to the decision made.
- Logging. The system records who, when, through which door, accessing what.
The fifth step disappears from everyday conversation most often, even though these records are audit material, the basis of incident investigations, and compliance evidence at audit time. A system that grants access without recording it leaves the company without a story.
Types of Access Control
“Types” gets used for two different things: the policy model and the credential method. Plenty of articles mix them until the list stops making sense:
| Meaning of “types” | The question it answers | What’s inside |
|---|---|---|
| Policy model | How the system decides permissions | DAC, MAC, RBAC, ABAC |
| Credential method | What proof a person presents | Cards, PINs, fingerprints, faces, apps |
Types by Policy Model
The policy model determines who gets to decide and on what basis:
| Model | How it works | Best fit | Risk to note |
|---|---|---|---|
| DAC (Discretionary Access Control) | Resource owner decides who gets access | Small teams, shared folders | Permissions spread: one “share” button can reach the wrong person |
| MAC (Mandatory Access Control) | Centralized and locked; individuals cannot change it | Strict data classification environments | Heavy administration; every change needs a process |
| RBAC (Role-Based Access Control) | Permissions follow a role or job title | Companies with clear departments | Roles pile up when nobody cleans them |
| ABAC (Attribute-Based Access Control) | Decisions weigh attributes: time, location, device, department | Dynamic environments, hybrid offices | Needs accurate attribute data |
Common practice combines RBAC as the frame with ABAC as the context refiner. One more development: Zero Trust demands every request be verified again, every time.
Types by Credential Method
A credential method is the proof a person presents, each with a daily-life example and a weak point:
- Card or RFID. The office badge tapped in the lobby. Cheap and fast; the weakness is lending it out or losing it unnoticed.
- PIN. A typed code, like at an ATM or door keypad. Nothing to steal physically; it leaks the moment it is shared or guessed.
- Fingerprint. The clock-in terminal in many offices. Cannot be lent out; the reader sometimes fails on wet or dirty fingers.
- Face. Face unlock on phones and newer attendance terminals. Touchless and fast; poor lighting often breaks the scan.
- Mobile credential and OTP. One-time codes in an app, or QR codes at parking gates. Convenient; it depends on a phone always carried.
Biometrics are the hardest to fake on this list, and precisely for that reason they carry their own consequence; the compliance section covers it.
Why Access Control Matters for Business
Access control matters for business because it closes the entry vector attackers use most often: credentials. Verizon’s Data Breach Investigations Report 2026 places stolen credentials among the most common initial access vectors, and the pattern repeats across editions: credentials stolen from one service keep opening others because victims rarely rotate them quickly. The most honest way to price access control is to look at the cost of its silence.
When something gets through anyway, the records become investigation material and compliance evidence. The operational side rarely gets counted: with permissions following roles, a new employee is set up in one pass.
Access control also shrinks the reach of one leaked credential: it should open one small door. When privileges pile up over years, one leak reaches everything. That climb is the pattern covered in privilege escalation.
Against automated attacks, the cheapest defense has long been proven: Microsoft calculated in 2019 that MFA can block over 99.9 percent of account compromise attacks.
Access Control and Compliance Requirements
Access control obligations apply from small businesses to corporations. The references that matter:
- Indonesia’s PDP Law (Law No. 27 of 2022) makes protecting personal data an obligation. Article 35 requires controllers and processors to apply technical and organizational measures against unlawful access. Access control is the most basic form of it: who can enter where, and since when.
- Biometric data counts as specific personal data. Article 4 of the PDP Law gives it stricter treatment, and fingerprints and faces used as credentials fall here. A biometric identifier cannot be replaced like a password: once it leaks, it leaks for good. Explicit consent, encrypted storage, clear retention, and processing records become requirements.
- ISO/IEC 27001 carries a dedicated control family for access. In the 2022 edition, Annex A spans Access control (5.15) through Access rights (5.18). Certification audits demand evidence of implementation; the mapping is covered in ISO 27001.
- PCI DSS and SOC 2 apply when you serve global markets. Both demand access control you can prove: who holds access to card data, since when, and when it was last reviewed.
For smaller companies, none of this means buying a large system. Start with keys (who can access what) and records (who accessed what, when). Clauses and sanctions belong with legal counsel; this article stays operational. Data governance is the wider roof above it.
How to Implement Access Control at Your Company
The five steps below are designed for companies without a dedicated security team. The order matters:
- Inventory what needs protecting. List the systems, shared drives, applications, and doors that hold anything important. Write down who genuinely needs access today; the list is usually shorter than expected.
- Set permissions per role, apply least privilege. Every role gets the minimum access its work actually uses, as covered in least privilege. Avoid shared admin accounts; fast today, expensive later.
- Put MFA on the accounts with the biggest impact. Company email, admin accounts, finance applications, and shared drives are enough to start; Microsoft calculated MFA blocks over 99.9 percent of account compromise attacks.
- Build one door for onboarding and offboarding. HR notifies IT and facilities the same day, using one checklist for everyone. Written down, it stops the access that never got revoked.
- Review on a schedule. Once a quarter, check who has access to what, then clean up the pileup. Temporary permissions from projects are the ones usually forgotten.
Two obstacles show up almost every time: MFA resistance and cost complaints. Both usually subside once the first step makes the numbers visible.
Offboarding Checklist
When someone leaves, this revocation order works as-is:
- Revoke system accounts on the last working day: email, internal applications, VPN.
- Deactivate the badge in the system and collect the card.
- Remove company credentials from personal devices used for work: email on the phone, VPN profile, work apps.
- Rotate passwords that were ever shared: office Wi-Fi, shared service accounts, door codes.
- Check the logs a few days after the effective date; activity on a revoked account needs an answer immediately.
Last, a check for this week: match active accounts and badges against the people still working. The difference is your first work list.
Ready to Manage Digital Identities as a Business Security Strategy?
Request a demo today and discover how IAM solutions centralize user logins through Single Sign-On (SSO), automate employee onboarding, and protect company data from unauthorized access without disrupting productivity with repeated logins.
Conclusion
Access control lasts when it becomes a habit. The technology can be simple; the discipline is what decides. Start with the one-minute check in the offboarding section.
If you need help drafting an access policy or preparing compliance evidence, Adaptist Consulting helps from a short discussion to full implementation.
The question that opened this article is still the first step: who has been able to walk in all this time?
