Physical access
Every portal is an edge fusion node: an encrypted secure channel on the strike path, camera feeds on a volatile ring buffer, and gait and face scored without ever interrupting throughput.
Readers are peripherals. The edge node is the authority.
Treating the reader as the decision-maker is how cloned credentials get through. The reader reports; the node decides.
Card readers are peripheral devices on an encrypted serial bus. The edge fusion node is the access control unit, and the secure channel is mandatory. A reader that can only speak the legacy cleartext protocol is a commissioning defect, not a supported fallback.
Cleartext operation is refused unless a time-boxed exception has been compiled into the active policy, at the lowest threat class, with an explicit expiry. It cannot be reached by clicking through a settings screen, and it cannot be reached automatically when a sensor fails.
The node keeps a signed snapshot of its access list and the last compiled policy. A site survives 72 hours with no connectivity to the control plane and keeps enforcing the policy it last verified. A broker outage does not open a door.
- Credential bus
- Encrypted serial, secure channel required
- Video ingest
- Standard IP camera streams, memory-resident
- Inference
- On-board accelerator, signed model artifacts
- Vector store
- Site-local, encrypted at rest
- Key custody
- Sealed to the node's own hardware root of trust
- Boot
- Measured, read-only root filesystem
- Offline survival
- 72 hours on the last verified policy
- Watchdog
- De-energizes the strike unless fire code forces open
What is allowed to make somebody wait.
Exactly one path can hold the barrier. Everything else runs beside it.
The blocking path
Decrypt the credential, check the local access list, check the epoch, release the relay. This is the whole of the blocking path, and it is budgeted at 80 milliseconds at the 99th percentile.
The path that never blocks
Approach cameras are already tracking inbound people before any credential is presented. Face embeddings attach in roughly 400 milliseconds; gait resolves over about two strides. The barrier has already moved.
Where the score is actually spent
A weak composite score on an asynchronous portal does not retract a barrier somebody has already walked through. It marks the session, escalates the next door, can lock that person's desktop, and raises an alert.
The portals that are allowed to wait
Interlocked entries and secure rooms are configured to hold the second door until the composite score clears. That is a deliberate throughput trade, made per zone, not a global setting.
Two ingest paths, one decision.
The credential path and the video path never share a buffer. No raw image crosses a process boundary as an argument.
credential reader ──[ encrypted serial ]──> reader daemon
│
IP camera ──[ video stream ]────────> frame ring (memory only, 3 s)
│
detect / pose / align
│
embed on device
│
┌──────────────┴──────────────┐
│ │
composite scoring plaintext wiped
│ keypoints dropped
▼ frames overwritten
portal decision state
When a sensor dies, the floor still holds.
Losing a camera must not quietly become a card-only building. Each failure has a defined behaviour, and it depends on whether the tenant floor permits card-only operation at all.
| Failure | If the floor permits card-only | If it does not |
|---|---|---|
| Face camera down | Drop the face weight and continue | Challenge or hold, and raise a sensor alert |
| Approach camera down | Gait weight to zero, no tailgate detection | Same, and every session is flagged as unmonitored for tailgating |
| Inference accelerator down | No biometric corroboration | Portal goes out of service unless a dual-control temporary rule exists |
| Secure channel down | Portal goes out of service | Portal goes out of service. There is no automatic downgrade, ever |
| Site broker down | Last retained policy and access list continue | Same, and events queue locally |
| Global bus down | Site-local decisions only, no new global revocations | Same, and the security team is notified |
The card names the person. The cameras only ever answer whether it is really them.
The properties that make this defensible.
Throughput
Asynchronous portals never queue behind gait analysis.
Tailgating
More tracked bodies than credential claims becomes a hold, not a shrug.
Presentation attacks
Passive detection runs on device; a strong spoof signal is a hard hold.
Bystanders
People who never presented a credential are never embedded.
Fail secure
A node losing power de-energizes the strike unless fire code requires otherwise.
Model integrity
Model artifacts are signature-verified before they are allowed to load.
Related
Bring the door onto the same epoch as the laptop.
We will walk you through a live portal, a compiled policy pack, and a revocation that closes the turnstile and locks the screen while you watch.