Plain-language definitions of the terms this industry actually uses — including the distinctions most publications get wrong.
A physical access control system delivered as a cloud subscription: the management software runs in the vendor's cloud rather than on a server at the site, and the customer pays per door or per month.
Not to be confused with Cloud access control.
The controller that receives credential data from readers and makes the grant/deny decision against stored access rules, driving the door hardware.
The device at the door that reads a credential (card, phone, PIN or biometric) and passes it to a controller for the access decision.
A small two-door space (a "mantrap") where the second door will not open until the first has closed, allowing only one authorised person through at a time.
Not to be confused with Tailgating.
A rule preventing one credential from being used to enter twice without an intervening exit — stopping a card being passed back to admit a second person.
The mathematical representation derived from a biometric sample (face, finger, iris). It is not a stored image and generally cannot be reversed into one.
A mobile credential presented over Bluetooth Low Energy, allowing longer read range and hands-free or in-app unlock.
Not to be confused with Near-field communication.
Access control whose management software and data live in the cloud, administered through a browser rather than a locally installed server.
Not to be confused with On-premises access control.
The token a person presents to prove they are authorised: a card, fob, mobile credential, PIN or biometric. What the reader reads.
Automatically provisioning and de-provisioning access from an identity source (e.g. Entra ID, Okta) so a leaver loses building access when they lose their login.
An alternate PIN that grants entry as normal while silently signalling to security that the user is being coerced.
The rate at which a biometric system wrongly accepts a non-matching person. The security-side error metric, traded off against the false rejection rate.
Not to be confused with False rejection rate.
The rate at which a biometric system wrongly rejects a legitimate, enrolled person. The convenience-side error metric, traded off against the false acceptance rate.
Not to be confused with False acceptance rate.
Biometric matching based on the ridge patterns of a finger, used at readers for verification or identification.
Searching a biometric sample against a database of many people to determine who it is. The basis of facial recognition and its surveillance concerns.
Not to be confused with Verification (1:1 matching).
The degree to which access control components from different vendors work together — readers, credentials, controllers, video and identity systems — without proprietary lock-in.
Not to be confused with Open architecture.
Biometric matching based on the pattern of the iris, offering very high accuracy at short range.
Techniques that confirm a biometric sample comes from a live person present at the sensor, defeating photos, masks and replays. Formally, presentation attack detection.
An access credential stored on a smartphone (or smartwatch) and presented over BLE or NFC, replacing a physical card.
Not to be confused with Proximity card.
Requiring two or more independent factors at a door — something you have (card/phone), know (PIN) or are (biometric) — for higher-assurance entry.
A very short-range (tap) radio used to present card or mobile credentials, the same 13.56 MHz technology behind contactless payment.
Not to be confused with Bluetooth Low Energy credential.
Access control whose management software runs on a server owned and maintained by the customer at or near the site, rather than in a vendor cloud.
Not to be confused with Cloud access control.
An access control design that uses non-proprietary readers, credentials and interfaces (e.g. OSDP, open card formats) so the buyer is not locked to one vendor.
Contactless biometric matching based on the subcutaneous vein pattern of the palm, which is hard to spoof because it is beneath the skin.
The system of readers, controllers, credentials and management software that decides who may open which door, when — as opposed to logical (IT) access control.
Software that aggregates and correlates alarms and data from many independent security systems — access, video, intrusion — into one operator view.
Delivering both power and data to a door controller or reader over a single Ethernet cable, simplifying wiring for IP-based access control.
A legacy 125 kHz contactless card that transmits a fixed number with no encryption — easy to use and easy to clone.
Not to be confused with Smart card.
A sensor or button that signals a controller someone is leaving, so the door can be released from the inside without triggering a forced-door alarm.
A 13.56 MHz contactless card (e.g. MIFARE DESFire, iCLASS SE) that uses mutual authentication and encryption, resisting the cloning that defeats prox cards.
Not to be confused with Proximity card.
An unauthorised person following an authorised one through a door on a single valid credential. Also called piggybacking.
Not to be confused with Anti-passback.
A physical entrance-control barrier (optical, tripod or full-height) that enforces one authorised passage per credential, physically preventing tailgating.
A radio technology that measures distance very precisely, used in access control to make unlock depend on the phone's exact position, resisting relay attacks.
Confirming a claimed identity by comparing a fresh biometric sample against that one person's enrolled template. The basis of facial authentication.
Not to be confused with Identification (1:N matching).
A door-entry device combining a camera, audio and a release control, letting a person or app verify a visitor before unlocking — central to multifamily access.
Software that records, stores and manages surveillance camera feeds. Increasingly unified with access control on a single platform.
Not to be confused with Visitor management system.
Software that registers, credentials and tracks guests — pre-registration, check-in, badge printing and host notification — often integrated with the access control system.
Not to be confused with Video management system.
The legacy point-to-point wiring interface between a reader and a controller. Unencrypted, unsupervised and one-way — the problem OSDP was created to replace.
A battery-powered electronic lock that communicates over a wireless link, extending access control to doors where wiring a controller is impractical.