Who decided that?

A new technician starts in the maintenance team on a Monday. Ten years ago that meant a form, a signature from her manager and a walk to the key desk. Now most of it happens before she arrives. HR creates her record, the access control system pulls it in overnight and by seven her card opens everything the maintenance group opens. Nobody had to do a thing and that’s pretty much what our industry has spent a decade working towards.

The maintenance group also opens the switch rooms and the roof. Someone set that group up by copying the profile of a caretaker who really did need all of it and every new starter since has inherited it. The system handed her a decision made for somebody else in 2019 and it did that perfectly.

I think that’s where most sites are now. We’ve got very good at handing out access and we haven’t got much better at deciding it. A cleaner feed from HR and a card on someone’s phone are both useful but neither tells you who decided she should have the switch rooms or whether that still holds a year later.

Even where the access control system takes its people straight from HR, the keys still go out at a desk on someone’s word. In her second week her card doesn’t open the plant rooms, so her supervisor signs a key out for her at the desk and the key register gets his initials. Now she holds access from two places. One came from a group nobody has looked at in years and the other from a supervisor on a busy morning. Neither says why.

Cybersecurity has been through this already. Accounts used to be handed out and forgotten the same way until deciding who gets access and setting it up became two separate jobs. The person who owns a system decides who should be in it, IT sets up the access and every few months somebody has to confirm it should still stand. Some sites already make that split for cards and some key desks run an approval for the sensitive keys. The yearly key check, where there is one, confirms she still has the key, not that she still should.

Deciding means the organisation says who should be able to open what, for what reason and until when. It says it once, whether the door takes a key or a card. So when a new security lead asks why, there’s an answer with a name and a reason on it.

You decide who can go where. We call that access authority. portierX applies the decision in the connected access control systems, issues keys against it and keeps every step on record. It’s open to invited organisations until its public launch in early 2027.

She’ll be fine. Her card works, her supervisor trusts her and the work gets done. She can also open the switch rooms, and the only decision behind that was made for a caretaker in 2019.