RFID Access Control: Credentials, Readers, and Revocation - Yenra

Inspect the whole access chain

On a small screen, scroll sideways to read both columns.

Longer read range can help a vehicle approach without stopping beside a reader. It also changes which vehicles and tags may be observed at once. Define the intended lane and presenting position, then test a neighboring tag, a passenger’s second credential and a vehicle waiting behind the first. Record the selected credential and actual access outcome.

Ask whether a credential merely supplies an identifier or participates in authenticated communication. The answer depends on the credential and configured application. A modern reader operating in a legacy compatibility mode may retain the older mode’s limitations. Require the supplier to identify what is actually deployed.

Verify the reader connection separately

The Security Industry Association defines OSDP as communication between access-control units and peripheral devices such as readers. Its Secure Channel protects that connection. This layer is separate from the wireless credential-to-reader exchange; list both in the design record.

SIA’s 2026 implementation checklist recommends configuring Secure Channel and verifying it in a staging test, along with the installed firmware and required controller features. Ask for evidence that the protected mode is active and survives restart. Keep cryptographic keys in the designated secure management system, outside ordinary acceptance worksheets.

Check exact product, firmware and profile in the OSDP Verified listings. The listing explains that verification alone does not guarantee every combination will interoperate. A mixed retrofit needs a documented account of which connections and credential modes remain in use.

Make permissions expire and revocation observable

Define who can request, approve and issue credentials. Tie access to the appropriate person or vehicle, with a start date, end date and permitted entrances. A contractor credential can have different limits from an employee badge. Record changes of role and the return or replacement of a tag.

Before handover, establish how each controller receives updates and what it does when disconnected. Test expiration and revocation under that documented behavior. Agree who checks propagation failures and how long the organization will tolerate uncertainty for each entrance. Thresholds belong to the site’s risk decision, not a generic product brochure.

Test outcomes, exceptions and recovery

1. Begin on a bench or approved test entrance using authorized test credentials. Verify permitted, expired, revoked and wrong-entrance outcomes, with expected times and logs recorded.
2. Check the full entrance cycle with the integrator: the granted decision, actual opening, closing and supported state reporting. Follow the equipment’s safe test procedure.
3. Test communications and power recovery under the approved plan. Confirm the documented entrance behavior, cached permissions and reconciliation of buffered logs.
4. Verify that an administrator can explain each event’s credential, controller, entrance, timestamp and decision reason without exposing unnecessary personal information.
5. Train the people who handle lost credentials, exceptions and alarms. Retain the configuration, acceptance evidence and escalation contacts.

A valid credential read identifies an access attempt. It does not by itself prove which person crossed, whether an additional person followed or whether a gate remained open. Define which events are observations and which require confirmation. Use staff procedures and appropriate entrance controls for those separate questions.

Set access-log purposes and retention periods with the site’s privacy owner. Limit who can browse or export movement history. A useful audit trail supports investigations and correction of mistaken associations; broad routine visibility of everyone’s movements creates a different operational risk.

Take the guide into your workflow

Download the working checklist (plain text). The editable text file includes its purpose, instructions, evidence fields and a link back to this guide. Record observed results and unresolved questions before making the decision.