Office building access control is a card or QR-based system that runs lobby turnstiles, tenant floors, visitor registration and parking in a multi-tenant building under one permission structure. Staff reach their own floor with a card; visitors reach only the floor they are visiting with a time-limited QR code. Building management sees who is inside on one screen.
Why an office building is not a factory
In a factory, one employer owns every door. In an office building, a management company runs the building, different tenants occupy the floors, and security and cleaning often come from separate contractors. Hundreds of staff pass through the same lobby in the morning, followed by visitors, couriers and maintenance crews through the day. In public buildings the same lobby problem meets heavy citizen traffic; we cover that in municipal building access control.
The problems in this setting are familiar. Visitors queue at reception, hand over ID in exchange for a visitor card, and by evening half the cards have not come back. A tenant moves out and nobody cancels its employees' cards. Out of hours, the only record of who is in the building is the guard's logbook. How hotels solve similar problems where guests and staff share one lobby is described in hotel staff access control.
We cover the building blocks of card access in our guide to card access control systems. This article applies the same principles to a multi-tenant office building. If you manage a residential complex, the requirements differ; we cover them in residential complex access control.
What you lose without office building access control
Security is the first loss, but not the only one. Office buildings are also where energy and running costs concentrate. According to the IEA's Energy Efficiency 2025 report, buildings account for around 30% of global energy demand. Air conditioning and lighting left running on an empty floor is typical waste in a building that does not know where its occupants are.
A 2017 study by the US Pacific Northwest National Laboratory (PNNL) found that widespread, correct use of controls could cut annual commercial building energy use by an average of 29%, yet only about 15% of US commercial buildings have building automation systems. (PNNL, Impacts of Commercial Building Controls on Energy Savings)
Occupancy is one of the most valuable inputs to those controls, and the most reliable occupancy data comes from access logs. User expectations are shifting too: HID Global's survey of more than 1,200 security professionals found that 39% of respondents actively use mobile identities (HID Global, 2024 State of Physical Access Control). The paper visitor book is steadily giving way to a code on the phone; we compare the options in our mobile access control guide.
There is a data protection side as well. Lobby cameras and access logs process personal data. A Turkish Data Protection Authority (KVKK) announcement of 8 June 2026 stresses that the purpose of cameras must be clearly defined, only authorised people should access the footage, and recordings should be kept for the shortest possible period and deleted by an automatic mechanism. An office building also raises the question of who is responsible for what: common-area records usually fall to building management, while tenant staff attendance data is the tenant's responsibility. Who may see which records, and who provides the privacy notice, should be agreed in writing between building management and tenants from the start.
Six steps to designing access control for an office building
- Layer the zones. The external door and lobby (open hours), the turnstile line, lift lobbies, tenant floors, technical areas (server room, roof, generator) and the car park should all be separate zones.
- Define the roles. Tenant staff, building management, security, cleaning and maintenance contractors, couriers and visitors. Write down the zones and time windows for each.
- Design the lobby flow. Work out how many turnstile lanes the morning peak needs, plus an accessible lane and a visitor lane. We compare the hardware in our guide to turnstile types.
- Bring visitors into the record. Give each visitor a time-limited, single-use QR code that carries permission only for the floor they are visiting. See QR code visitor management for the method.
- Manage card sharing and queues. An anti-passback rule stops one card letting two people through the lobby turnstile, which also keeps the logs reliable for attendance and occupancy.
- Connect emergency and building systems. Plan the evacuation list of who is still inside, fire-alarm release of escape doors and occupancy-based HVAC and lighting control from the outset.
Who goes where, and when
| Role | Lobby / turnstiles | Tenant floor | Technical areas | Car park | Credential |
|---|---|---|---|---|---|
| Tenant staff | Working hours plus agreed extra hours | Own floor only | No | If assigned | Permanent card |
| Visitor | Appointment time | Visited floor only | No | Linked to appointment | Time-limited QR |
| Cleaning contractor | Shift hours | Assigned floors | No | No | Permanent card |
| Maintenance | For the work order | If required | Area in work order | If required | Time-limited QR or card |
| Building management | Always | Floor common areas only | Yes | Yes | Permanent card |
This table is what lets you update permissions in a single step when a tenant or contractor changes.
Out-of-hours access deserves its own rule. Some tenants work at weekends or late at night; extra hours for those people should be granted at the tenant manager's request and for a limited period. Otherwise permissions opened "just this once" become permanent, and nobody knows who is in the building at night. The same logic applies to maintenance: when the work order closes, the permission should end with it.
Courier and delivery flows should also be decided early. Should couriers go up to the floor, or should deliveries be left at a drop-off point in the lobby? The second option reduces both lift traffic and the number of strangers entering tenant floors.
Parking, cameras and building automation
In many office buildings the first access point is the car park barrier. Letting tenant vehicles in by plate and visitor vehicles by appointment also shortens the lobby queue; we cover this side in our parking management system guide.
Pairing cameras with access events makes it easier to investigate an incident in the lobby or a technical area. The camera's purpose must be written down, though, and disproportionate practices such as audio recording avoided. We summarise the compliance framework in KVKK compliance in Turkey.
On the automation side, access data is the most reliable source for which floors are occupied. Combined with a building management system (BMS), it lets lighting and air conditioning on empty floors follow actual use rather than a fixed timetable. Management companies with several buildings will find multi-site access control useful.
How we deliver office building projects at Digital Bridge
- Survey and requirements analysis. We inspect the lobby, lift lobbies, tenant floors, technical areas and car park on site, and draw up the role and zone table with building management. Processes such as how tenants report changes to their staff lists are settled at this stage.
- Hardware. We use our card access control solutions for lobby turnstiles and floor doors, and licence plate recognition for car park entrances. Technical feasibility is free, and scope and cost are set out in a written proposal.
- Integration with building systems. Our smart building and BMS projects work with Modbus, BACnet, KNX and DALI; how access data feeds lighting and HVAC scenarios is defined during the survey, based on the building's infrastructure. Lobby and technical area cameras are managed over ONVIF on our IP camera monitoring platform.
- Data protection. Our data protection compliance service covers privacy notices for tenant staff and visitors, retention periods and access rights.
- Pilot. We start with the lobby and one tenant floor, then extend to the remaining floors. For the general installation sequence, see our access control system installation guide; if the building already has an older system, our guide to replacing a legacy access control system explains a staged cut-over that does not disrupt tenants.
A day in an office building with SmartPass
Our own product, SmartPass, suits office buildings with its zones, access groups and weekly time profiles. At 8:40am a tenant employee presents a 13.56 MHz card at the lobby turnstile. Their "Tenant A" access group is linked to the Lobby and Floor 5 zones with a time profile covering weekdays from 07:00 to 21:00, and the turnstile opens. The same read creates an attendance record, so the tenant needs no separate attendance device.
At 11am a pre-registered visitor collects a temporary card at reception and passes through the same turnstile. The card follows the same rules as a staff card, and its rights are limited to the visit's access group and duration, so it opens only the floor being visited; the host is notified by email and the card is returned on the way out. When a rule changes in the panel, it applies at every door at once.
During a fire drill, building management sees on the dashboard how many staff, contractors and visitors are inside right now, and checks the headcount at the assembly point against those numbers. In a security incident, an access point can be locked from the panel; a point switched to emergency mode lets people out but not in, and an email goes to the organisation's notification recipients. Releasing escape-route doors on a fire alarm is configured separately, in line with fire safety rules. For data protection, card numbers are not stored, only a one-way hash and the last four digits; once the retention period ends, fields that identify the person are deleted automatically; every change is kept in the audit log with its previous and new value, and panel access is limited through 43 separate permissions.
Next step
Put your floor plans, tenant list, daily visitor volume and number of car park entrances on one page. Then get in touch or call us on +90 552 380 25 25; we will build the role and zone table with you and show SmartPass running your building's scenario. For more guides, visit our Access Control & Attendance hub.