An enterprise role model separates a person’s authority to enter a building from an administrator’s authority to change the system. This distinction helps corporate standards coexist with responsible local control.
Part of Enterprise Access Control Systems.
Define entry and administrator roles
Define ordinary users, local administrators, regional administrators, corporate approvers, technical administrators, and service roles. List the sites and actions each role needs. Viewing events, issuing a credential, changing a schedule, exporting records, and assigning another administrator are separate decisions. Build role definitions from actual work rather than copying the permissions of the first system owner.
Limit temporary and cross-site permissions
Temporary assignments, cross-site transfers, and shared facilities can require exceptions. Specify who approves them, when they expire, and how they are reviewed. Avoid giving a local administrator organization-wide authority merely to solve one urgent task. Confirm whether the selected platform supports the intended boundaries and document any limitation that changes the operating model.
Test allowed and denied actions
Use test identities representing each role. Demonstrate permitted actions and attempted actions that should be denied. Check visibility across sites, inherited permissions, administrator changes, and audit records. Have the responsible business owner review the matrix before broad enrollment and after material organizational changes.
Related planning resources
Frequently Asked Questions
Are physical-entry permissions and administrator permissions the same?
No. Entry permissions determine where a person may go; administrator permissions determine what that person may change in the system. Define and review the roles separately so local responsibility can coexist with corporate standards.
How should delegated security administration be verified?
Test both allowed and denied administrative actions for the assigned roles. Include temporary and cross-site permissions in the review. A working login does not prove the administrator’s authority is limited as intended.
Let’s talk about your next step
Tell us what you want to improve and which locations are involved. We can help you work through the questions, check what your systems support, and define a practical project scope.
Compliance, Codes & Project Standards
NERSA plans commercial and industrial security work with applicable code, documentation, inspection and authority-having-jurisdiction requirements in mind. Requirements vary by system, property and jurisdiction. These resources support project planning; they do not establish legal compliance, certification or AHJ approval.
Related guidance: Regulatory compliance & inspection readiness · NERSA project standards · Documentation, testing & inspection readiness