A door access control system is the combination of a credential reader, a door controller, and an electric lock that decides, in real time, whether a specific door should open for a specific person. The reader captures a credential, the controller checks it against a permissions list, and the lock releases or stays engaged based on that decision.
- Most commercial door controllers are rated under UL 294, the UL standard for access control system units.
- Fail-safe versus fail-secure locking on a given door is usually decided by fire and life-safety code, not by the security team’s preference, under standards such as NFPA 101.
- Legacy Wiegand wiring sends an unencrypted, one-way, typically 26-bit signal from reader to controller; OSDP is bidirectional and supports AES-128 encryption.
- A Power over Ethernet controller drawing under 15.4 watts fits the IEEE 802.3af budget; higher-draw locks and multi-door panels often need 802.3at, up to roughly 30 watts.
- Credential technology has moved from 125 kHz low-frequency proximity cards, which are simple to clone, toward 13.56 MHz smart cards such as MIFARE DESFire, which support on-card encryption.
What a Door Access Control System Actually Includes
A working access control deployment at a single door is rarely one device. It is a small chain of hardware that has to agree with itself in under a second, every time someone approaches the door.
Credential Readers
The reader is the part people touch: a card reader, a keypad, a mobile-credential panel, or a biometric sensor. Its only job is to capture whatever the person presents and pass it upstream. Read range depends heavily on frequency: 125 kHz proximity typically reads from a few inches, while 13.56 MHz smart cards and mobile credentials using RFID or Bluetooth can read from a greater distance, which is why some sites deliberately choose a shorter-range card over a longer-range one to avoid a reader firing for someone still in the hallway.
Door Controllers
The controller is the decision-maker. It holds (or checks against, if cloud-connected) the list of who is allowed through that specific door at that specific time, and it is the point that logs every attempt, granted or denied. Controllers range from a single-door board mounted in the door frame to a multi-door panel in a communications closet serving an entire floor.
Electric Locks and Fail Modes
The lock is where code, not preference, usually makes the final call. A fail-safe lock unlocks when power is cut, which life-safety code requires on doors along a primary egress path so people are never trapped during a fire or power outage. A fail-secure lock stays locked when power is cut, which is common on doors like server rooms or cash-handling areas where controlled entry matters more than instant free egress on power loss. NFPA 101, the Life Safety Code, is the document that most local fire authorities point to when deciding which doors must be fail-safe.
How the Components Talk to Each Other: Wiegand vs. OSDP
The wiring protocol between reader and controller determines how much a stolen or copied signal is actually worth to an attacker.
| Property | Wiegand | OSDP |
|---|---|---|
| Direction | One-way, reader to controller | Two-way, reader and controller exchange data |
| Encryption | None; card number sent in the clear | AES-128 supported (OSDP Secure Channel) |
| Typical format | 26-bit card number, fixed length | Variable-length data, supports larger credential formats |
| Reader health reporting | Not supported | Controller can detect a disconnected or tampered reader |
| Cable run | Shorter practical distance | Longer practical distance on the same wire gauge |
Wiegand is still common because so much existing wiring and so many existing readers use it, and replacing wiring is the expensive part of any upgrade. OSDP is the newer standard and is what most manufacturers now recommend for new installs, specifically because an unencrypted Wiegand line can be tapped and replayed with inexpensive, widely available hardware.
Where a Door Access Control System’s View Ends
A door controller only knows what the reader told it. It has no way to know whether the person who tapped a card was followed through the door by someone else, a pattern known as tailgating or piggybacking, and no way to flag that the credential holder badged in at one building entrance and, four minutes later, badged in again at a door on the opposite side of campus, which is not physically possible for one person to have done legitimately. Closing that specific gap is what a camera layer on the same doors is for, since it can see who is actually standing at the door rather than only which credential was presented.
Standalone, Networked, and Cloud-Managed Controllers
A standalone controller manages one or two doors with no network connection at all, which is common in small offices and cheap to install but has no central reporting and no remote lockdown. A networked, on-premises system ties every door controller back to a local server that holds the full permissions database, which is the model most mid-size and enterprise sites still run. A cloud-managed system moves that permissions database off-site, so administrators can add or remove a credential from a phone without VPNing into a local server, at the cost of depending on internet connectivity for real-time changes (though doors typically keep working locally if the connection drops, using the last-synced list). Anyone comparing access control vendors for a multi-site rollout will usually find this architecture decision, more than any single feature, determines how the system feels to administer day to day. For a business-wide view of specifying readers, controllers, and software, read our guide to the commercial access control system. If you are considering phones instead of cards, see how mobile access control works.
Frequently Asked Questions
What is the difference between a door access control system and a key card entry system?
A key card entry system is one specific type of door access control system, built around a card credential and a reader. Door access control is the broader category, which also covers keypads, mobile credentials, and biometric readers on the same controller hardware.
Do all doors in a building need the same lock type?
No. Fail-safe versus fail-secure is decided door by door, based on that door’s role in the building’s egress path and what is behind it, not applied uniformly across a site.
Can Wiegand and OSDP readers run on the same controller?
Many modern controllers support both, either on separate reader ports or through a Wiegand-to-OSDP adapter, which is how most sites upgrade one door at a time instead of replacing every reader at once.
What happens to a door access control system during a power outage?
Fail-safe doors on egress paths unlock. Fail-secure doors stay locked, and battery backup at the controller typically keeps logging and reporting running for a limited window even though the doors themselves no longer read new credentials once the backup is exhausted.
Does adding cameras replace the need for a door controller?
No. The controller still makes the lock decision. A camera layer adds visibility the controller cannot have on its own, such as confirming one person per credential and catching a door propped open after a legitimate entry, without changing who is authorized to unlock the door.
A door controller decides who gets through. It has no way to confirm that the person who tapped the card is the only person who walked through, or that the door closed and latched behind them. Argu runs on the cameras a site already has at these doors and lets a security team write that second rule as a sentence, such as flagging more than one person following a single badge-in, instead of buying a dedicated tailgating sensor for every door. Contact Argu to talk through which doors on your site carry the most risk.
Last updated: September 2026
