Guides
Ship revocation and epochs before a biometric gallery. That is the implementation order, and the reason for it is a security argument rather than a preference.
Why the order is not negotiable.
Each phase is deliberately useful on its own, so a programme that stops after phase two has still improved the organisation's position.
The temptation with converged access is to build the impressive part first. Biometric corroboration at a turnstile demonstrates well, and it is the phase most likely to be funded. It is also the phase that is actively dangerous without the ones before it.
A gallery with no working global kill path invites an organisation to trust a stronger signal while removing its ability to withdraw that trust quickly. So revocation comes first, proven against nothing more exotic than an account being disabled in a directory, where it delivers the highest security return per week of work.
The six phases.
Sequenced by security return, not by demonstrability.
Epochs and the revocation path
Wire epoch increments to your existing account state and directory disable events. The desktop agent can start as a thin lock daemon. This alone closes the gap where a leaver keeps an unlocked machine.
Portal controllers and signed access lists
Bring readers onto the encrypted secure channel behind a proper access control unit, with signed access list snapshots. Credential-only portals, bound to the location tree. No biometrics yet.
The policy compiler
Introduce compiled packs, the threat class toggle, and dual-control floor enforcement. Wire the gate-pass approval chain in as a decision attribute. Now posture changes are cheap and auditable.
Edge inference
Add gait first, then face, with the site-local vector store, the drop pipeline, and the lawful-basis compile gate. This is the phase that needs phase one to already be true.
Full desktop state machines
Move from a lock daemon to the complete macOS and Windows agents, with continuous liveness, foreign-face handling, and step-up requirements.
Interlocks and secure rooms
Last, because an interlocked portal that holds people on a mistuned threshold is worse than no interlock. It needs everything before it to be correct and tuned.
If only one sentence from these guides survives into your programme plan, make it this one. A biometric gallery with no proven global revocation is a worse security posture than the credential-only building you started with.
Commissioning rules that prevent expensive mistakes.
Each of these has a specific failure it exists to prevent.
| Rule | The failure it prevents |
|---|---|
| No default keys left after installation | A reader estate that can be cloned by anybody who read the manufacturer's documentation |
| Cameras on their own network segment | A camera compromise becoming a route into the corporate network |
| Signed model artifacts only | An unsigned model being swapped for one that always scores highly |
| Never silently update a template | Appearance change being absorbed into a template until it matches somebody else |
| Tune thresholds on a labelled week | A global constant producing a false accept rate nobody measured at this site |
| Legacy cleartext readers replaced, not tolerated | A permanent exception that quietly becomes the fallback path |
| Verify offline survival before go-live | Discovering during an outage that portals fail open |
Practical sequencing advice.
Start where the register already is
If the asset register is accurate, phase one is mostly configuration.
Pick one building
Prove the full path in one location before scaling the pattern.
Measure before tightening
Run a phase at its floor and look at the hold rate before raising it.
Enrollment is a project
Budget for the ceremony, the lawful basis record, and the re-enrollment path.
Interlocks need tuning time
Allow a labelled week per site before an interlocked room goes live.
The estate modules stand alone
Register, desk, knowledge, and gate pass can run years ahead of any portal.
Who to write to.
Phase one is smaller than it sounds.
For most organisations the first phase is configuration against a directory they already run. We will scope it honestly, including telling you when it is not worth starting.