The responsibility sits with the facility’s security or access-control function, acting under a designated authorizing official who owns the access list and signs off on credentials. In most organizations that means a security director, physical security manager, or cognizant security authority, supported by HR for identity proofing and by IT for the technical access-control system. The person who maintains the list is rarely the person who approves access, and that separation is deliberate.
Access control looks simple from the outside: a badge, a door, a reader. The governance behind it is a chain of accountable roles, each holding a piece of the authority to say who gets in. Understanding that chain explains why audits fail, why orphaned credentials persist, and why "the list" is never just a spreadsheet.
The accountability chain behind a secured door
Physical access control splits into four functions that are easy to blur together. Identity proofing confirms a person is who they claim. Authorization decides whether that person should reach a given space. Credential issuance converts the decision into a badge, key, or biometric enrollment. List maintenance keeps the record current as people join, move, and leave.
Each function tends to live with a different owner. Human resources or a vetting office handles identity proofing and background checks. The line manager or facility owner requests and justifies access. The security department approves and issues. The access-control administrator maintains the authoritative list and reconciles it against the physical system.
The counterintuitive detail: the person who can grant access should not be the person who can silently edit the list. Where one individual controls both authorization and record-keeping, a single compromised or careless actor can add a name with no paper trail. Mature programs enforce separation of duties so that every addition requires two sets of hands.
Plain-language version: someone decides, someone else records, and a third party checks that the two agree.
How the list and credentials actually stay current
A current access list is a living reconciliation, not a static file. The mechanism works by tying every credential to an authoritative source of truth about employment or affiliation, then detecting drift between that source and the access-control system.
The authoritative source is usually the HR system of record or a contractor-management database. When a person is terminated, the HR record changes state. A well-built integration propagates that change to the access-control system within a defined window, automatically suspending the credential. Where no integration exists, a human must translate the termination into a deactivation, and that handoff is where most failures occur.
Credentials themselves come in tiers. A low-assurance badge may only open a lobby turnstile. A high-assurance credential for a secure room might combine a smart card with a PIN and a biometric template. The issuing authority must match the tier: a lobby badge can be issued by a front-desk administrator, while a restricted-area credential usually requires sign-off from the facility’s security office and sometimes a government or corporate security authority.
Periodic revalidation keeps the list honest. Many programs require access reviews at fixed intervals, where managers confirm or revoke each person’s access. The review cadence is the maintenance heartbeat, and skipping it is how stale entries accumulate.
Quantified context: cadence, counts, and drift
Numbers make the governance concrete. Access reviews commonly run quarterly for high-security areas and annually for general office space, though regulated environments may demand more frequent cycles. A facility with 2,000 badgeholders generating roughly 15 percent annual turnover faces about 300 departures a year, or more than one credential to deactivate every working day.
Drift is the gap between who should have access and who does. A single missed deactivation leaves a live credential in the wild. Industry audits routinely find orphaned accounts and badges when reconciliation is manual. The exposure window equals the time between a person leaving and someone noticing, and that window can stretch for months without an automated trigger.
Credential lifespans vary by tier. Visitor badges may expire in a single day. Standard employee badges often carry a multi-year validity with periodic revalidation. High-security credentials may require renewal on a shorter cycle tied to a background reinvestigation. Each lifespan is a design choice balancing convenience against the risk of a lost or stolen credential staying valid.
Where the model breaks: edge cases and red flags
Edge cases expose weak governance faster than routine operations. Contractors, temporary staff, and visiting researchers often sit outside the HR system of record, so the automatic termination trigger never fires. Shared service accounts and generic "maintenance" badges can persist indefinitely because no single person owns them.
Red-flag warnings to watch for:
A badge that remains active after the holder’s HR record shows termination. One administrator who can both approve and issue high-security credentials. Contractor or vendor access with no expiration date and no named sponsor. Access reviews signed off without evidence that anyone checked the list. Physical keys or codes that exist outside the electronic access-control system entirely. Credentials issued before identity proofing is complete.
The professional caveat: electronic access logs prove a credential was used, not who used it. A shared badge or a borrowed card defeats the audit trail, which is why high-assurance areas pair credentials with something the person knows or is.
Common misconceptions about who owns access
The most persistent misconception is that IT owns physical access because it runs the badge system. IT typically operates the platform, but the security function owns the authorization decisions and the list’s accuracy. Confusing platform ownership with policy ownership leaves accountability unassigned.
A second misconception treats the access list as a static document produced at audit time. In practice it is a continuously reconciled record, and an auditor asking for "the current list" expects evidence of ongoing maintenance, not a snapshot.
A third error assumes a valid credential proves current authorization. A badge can remain technically valid long after the person’s role changed. Validity and authorization are different properties, and only revalidation keeps them aligned.
Roles compared across program types
Different environments assign the same functions to different offices. The table below maps who typically holds each function; exact titles vary by organization.
| Program type | Authorizing official | List maintainer | Credential issuer | Revalidation owner |
|---|---|---|---|---|
| Corporate campus | Facility security manager | Access-control administrator | Badge office | Line managers |
| Government classified facility | Cognizant security authority | Security office | Security office | Security office |
| Healthcare restricted area | Facility security director | Access administrator | Security desk | Department heads |
| Data center | Site security lead | DC operations | Site security | Compliance team |
| Laboratory / research | Biosafety or security officer | Lab administration | Security office | Principal investigators |
The pattern across all five: authorization, maintenance, and issuance rarely sit with one person, and revalidation is delegated to the people closest to the work.
Timeline of a credential’s life cycle
Access governance follows a predictable time course from request to revocation. The table shows the stages and what should happen at each.
| Stage | Typical timing | Governance action |
|---|---|---|
| Access request | Before day one | Manager justifies scope; security reviews |
| Identity proofing | Pre-issuance | HR or vetting confirms identity and eligibility |
| Credential issuance | Day one | Badge office enrolls and activates tier-appropriate credential |
| Periodic revalidation | Quarterly to annually | Manager confirms or revokes each access right |
| Role change | On transfer | Access re-scoped to new duties; old rights removed |
| Separation | Within defined window | Credential suspended, then revoked and collected |
| Audit reconciliation | Scheduled | List compared against system and HR records |
The separation row is where programs most often slip. A defined deactivation window, measured in hours or a small number of days, is the single most useful control a facility can set.
Practical actions to keep the list defensible
Concrete steps make the governance real and auditable.
Define the authorizing official by name and title in policy, not by department. A named owner can be held accountable; a department cannot.
Tie every credential to an authoritative record. Where contractors fall outside HR, create a sponsor field so each has a named employee accountable for their access.
Set a deactivation window and measure it. Track the time from separation to credential suspension and report the median and worst case.
Run reconciliation against the physical system, not just the spreadsheet. The access-control platform’s active-credential report is the ground truth to compare against the authoritative list.
Require separation of duties for high-assurance credentials. Approval, issuance, and record-keeping should involve at least two people.
Reconcile multiple thresholds explicitly. If HR deactivates in one day, the badge system suspends in one day, and physical key collection takes a week, the true exposure window is the longest of these, not the shortest. Align the thresholds or accept and document the gap.
Limitations and what governance cannot guarantee
No access program eliminates insider risk. A correctly issued credential in the hands of a trusted person who later becomes untrustworthy defeats the entire control chain. Governance manages who is authorized, not what an authorized person chooses to do.
Automation reduces drift but does not remove it. Integrations fail silently, HR records carry errors, and contractors slip through gaps. The reconciliation step exists precisely because no single system is authoritative on its own.
Small facilities often cannot justify full separation of duties. In those cases the compensating control is independent review: someone outside the access function periodically checks the list against the system and the HR record. The principle survives even when the staffing does not.
Finally, the answer to who is responsible is organizational, not individual. A named authorizing official owns the outcome, but the list stays current only when HR, security, IT, and line managers each perform their part of the chain. The credential at the door is the visible end of a governance process that succeeds or fails upstream.
This article is general educational information about access-control governance, not a legal opinion or a compliance certification. Specific requirements for secured facilities vary by jurisdiction and contract, so consult a qualified security or compliance professional for your site.