Identity opens the first door. Shift, role, and safety status decide the rest of the factory.

A factory is not one access zone

Passing the perimeter does not mean a person should enter every part of an industrial facility. Offices, production lines, warehouses, loading areas, laboratories, clean rooms, utilities, control rooms, workshops, chemical stores, and maintenance areas carry different operational and safety conditions. The appropriate authorization can also change by shift, day, shutdown phase, product run, or work activity.

The population is equally varied. Permanent employees, temporary workers, agency staff, contractors, service engineers, delivery drivers, auditors, and visitors may all arrive through the same perimeter. Their approval owners, working hours, training requirements, supervision rules, and offboarding triggers are not the same. A single badge profile that remains valid until somebody remembers to cancel it is therefore a weak model.

Identity is the anchor, not the complete decision

A biometric comparison can establish that the person presenting at the reader corresponds to an enrolled identity. The access decision still needs current facts. Is the employment record active? Is the contractor company approved? Is the worker assigned to this site and shift? Are required induction, competence, medical, or certification records current? Does the role allow entry to this zone at this time? Is an escort, supervisor approval, or active work permit required?

This distinction prevents a common design error: treating a successful face, fingerprint, iris, or palm-vein match as automatic permission. Stronger identity assurance makes the policy decision more trustworthy, but it does not replace policy.

Build the decision from authoritative sources

Each source should own the fact it understands best. HR should not manually maintain door groups after every transfer. Security should not be expected to interpret training spreadsheets at the turnstile. A permit system should not silently turn a person into a permanent zone member. Integration translates these authoritative facts into a clear, auditable result.

Follow identity through the complete shift

Factory access is most dependable when the whole lifecycle is designed—not only the moment a person looks at a reader. The lifecycle begins before arrival and continues until the worker is off site, permissions are closed, and exceptions have been reconciled.

Shift handover is both a capacity and policy event

At handover, an outgoing shift may leave while the incoming shift arrives, supervisors exchange responsibility, temporary overtime is approved, and maintenance teams enter between production windows. The system should not simply widen a time rule until everybody fits. It should represent planned overlap, early-arrival tolerance, authorized overtime, and the owner who can approve an exception.

Throughput matters as much as policy. Count the busiest arrivals in five- or ten-minute intervals, not only the daily workforce. Provide enough normal lanes, an accessible route, and a separate assisted path for workers whose identity or eligibility needs attention. A person with an expired certification should not hold the lane while security searches emails.

Employees and contractors can share identity infrastructure without sharing governance

Both populations may use the same biometric terminals and controllers. Their lifecycle should remain distinct. HR normally owns employee status, department, manager, and schedule. Procurement, a sponsor, contractor administrator, or site owner may control the contractor company, worker assignment, documents, induction, and contract period. The access platform consumes both forms of eligibility while preserving the correct approval trail.

Biometriya HRM can connect employee identity, attendance, leave, and schedules. Contractor Management and Site Access handles company and external-worker readiness. The factory access layer turns current status into entrance and zone decisions.

Work permits are narrower than general access rights

An active employee may be allowed into the facility but still lack authority to perform confined-space entry, hot work, electrical isolation, line breaking, or another controlled task. An electronic permit to work coordinates the task, location, hazards, controls, approvals, validity, and work team. It should not be reduced to a permanent door group.

Biometriya ePTW can connect a verified person to the active permit workflow. Access integration may then support a time- and area-specific control, but the permit process and the physical access process remain separately auditable.

Design zones around risk, work, and physical movement

A useful zone map reflects how people work and move. It should avoid creating dozens of groups that operators cannot maintain, while still separating areas where the consequences of unauthorized or unready entry are materially different.

Use the right biometric checkpoint for the environment

Factories rarely have one universal capture condition. A sheltered employee entrance, dusty workshop, gloved clean-room transition, remote tank farm, and high-assurance control room need different interactions. Select the modality, device, mounting, and operating procedure for the location rather than standardizing on one reader without field testing.

FacePass can suit high-volume, touchless workforce entry when lighting, camera position, face visibility, and presentation are controlled. BioDuo 2 adds face and iris options for checkpoints that need higher assurance or modality flexibility. EOS Palm Vein provides a contactless palm-vein option for hygiene-conscious controlled areas. Rugged mobile verification with Aegis can extend identity checks to remote plant, turnaround, and temporary work locations.

Test the chosen method with the actual population, PPE, eyewear, gloves, lighting, dust, temperature, device height, queue direction, and cleaning regime. Mandatory PPE should not be removed in a hazardous approach simply to satisfy a reader. Where one biometric is unsuitable, redesign the capture point or provide a controlled alternative.

Vehicle and pedestrian access need connected but distinct treatment

Industrial yards bring pedestrians, forklifts, delivery vehicles, employee cars, and heavy goods vehicles into the same operating environment. Workplace transport risk assessment should consider vehicle and pedestrian movement, route separation, crossings, visibility, loading areas, signs, lighting, and visitors. A vehicle credential or number plate identifies a vehicle; it does not automatically establish the identity or authorization of every occupant.

Driver identity, passenger handling, delivery purpose, vehicle approval, gatehouse checks, and pedestrian transfer should therefore be designed explicitly. Optional edge intelligence such as Biometriya AI Box can add operational awareness around people, vehicles, PPE, smoke, and monitored areas, but analytics complement rather than replace controlled identity and safe traffic design.

Do not confuse attendance, access, and current presence

An attendance event supports payroll and timekeeping. An access grant records a decision at a checkpoint. Confirmed passage provides stronger evidence that a person crossed. Current presence is an interpreted state based on entries, exits, internal movements, missed transactions, visitors, vehicle passengers, mobile checkpoints, and corrections. These are related records, not interchangeable facts.

Emergency teams need to understand the confidence of the count. Access history can support mustering and investigation, but it should not be presented as proof that every person is safe. The emergency process must handle unknown state, missed exit, tailgating, manual override, communications loss, and people already outside the controlled perimeter.

Industrial access must remain dependable when dependencies fail

A factory cannot assume the wide-area network, central server, HR integration, or cloud service is always available. The architecture should define which identity templates, access rights, schedules, and revocations are held locally; how old cached policy may be; how events are stored and synchronized; and how each class of door behaves if communication is lost.

Choose offline behavior by consequence

The safest response is not identical everywhere. A main workforce entrance may use a recent local list to keep an approved shift moving during a short outage. A control room, chemical store, or critical utility area may deny entry unless current high-assurance policy is available. Emergency egress and life-safety functions remain governed by the facility's fire strategy, regulation, and certified hardware—not by attendance convenience.

CISA guidance for centrally managed physical access systems recommends testing what happens when communication between the central application and readers is interrupted. Sites should know whether each controller continues with its last valid configuration, denies transactions, or follows another defined state. This behavior should be documented and exercised, not discovered during an outage.

Protect the management plane as carefully as the gate

A reader can be physically secure while its central administration is weak. Protect administrator accounts, approvals, controller communication, device configuration, integrations, audit logs, biometric data, and export functions. Apply least privilege, separate duties where practical, monitor configuration changes, maintain inventories of access devices, and revoke rights promptly when a person transfers or leaves.

Industrial facilities should also respect the boundary between business IT, physical security, and operational technology. Access integrations should exchange the minimum necessary data through controlled interfaces. A convenience integration should not create an uncontrolled route into plant networks or make a production door depend on an unrelated enterprise service.

Prepare a governed manual mode

Manual operation is sometimes necessary during a major outage, evacuation recovery, exceptional call-out, or damaged checkpoint. Define who can authorize it, what identity evidence is acceptable, which zones remain closed, how temporary decisions expire, how events are recorded, and how the final record is reconciled. A manual mode that is neither logged nor time-bound becomes a bypass.

Test the decision, the lane, and the recovery process

A factory pilot should include real shift patterns and representative people: permanent staff, contractors, temporary workers, drivers, visitors, new starters, transferred workers, suspended identities, expired certifications, overtime approvals, and emergency call-outs. Test day and night conditions, PPE, alternative modalities, high traffic, offline operation, delayed integrations, controller restart, and barrier faults.

Useful operating measures

• Entry flow: arrivals per interval, median and 95th-percentile passage time, maximum queue, and assisted-lane demand.
• Biometric performance: capture retries, unresolved identities, false rejections, duplicate records, and re-enrollment rate.
• Policy quality: denials by reason, expired readiness, wrong shift, wrong zone, missing assignment, override rate, and override owner.
• Presence quality: unmatched exits, anti-passback exceptions, unknown state, manual correction, and muster reconciliation.
• System health: controller availability, device faults, integration latency, offline duration, cache age, synchronization backlog, and recovery time.
• Governance: overdue access reviews, dormant identities, active leavers, privileged-account changes, and temporary rights that failed to expire.

Review metrics by site, entrance, device, shift, zone, workforce type, and denial reason. A healthy overall average can hide a night-shift lighting problem, a contractor-onboarding delay, an overloaded loading gate, or a reader that fails more often for one part of the population.

A practical factory access-control checklist

• Identity: Is every credential bound to a quality-controlled, unique worker identity?
• Ownership: Is there a named system and business owner for employment, contractor, training, shift, permit, and zone facts?
• Lifecycle: Do hire, transfer, leave, suspension, contract expiry, and emergency revocation change access promptly?
• Zones: Does the map reflect operational risk without becoming impossible to administer?
• Time: Are shift overlap, overtime, call-out, grace periods, and exception approvals explicit?
• Capture: Has each biometric method been tested in its real environment with its real population and PPE?
• Traffic: Are pedestrians separated from vehicle hazards and are driver and passenger decisions defined?
• Resilience: Is offline behavior known for every important checkpoint and tested under realistic loss scenarios?
• Life safety: Are emergency egress and fire requirements independent of normal identity transactions?
• Evidence: Can the facility explain who changed a right, why a decision occurred, and how an exception was resolved?

The strongest industrial access model is not the one with the most restrictive door groups. It is the one that converts current identity and operational facts into predictable decisions, responds quickly when those facts change, and keeps safe movement possible during normal shifts, shutdowns, incidents, and technology failures.

Independent guidance and resources

• UK HSE: Workplace transport safety — guidance on assessing movement of vehicles and people, separating routes, crossings, signs, lighting, loading areas, and visitors.
• UK HSE: Site layout and workplace transport — practical considerations for safe routes, pedestrian movement, visibility, and workplace layout.
• US OSHA: Process Safety Management of Highly Hazardous Chemicals — contractor evaluation, hazard and emergency training, and practices controlling entrance, presence, and exit in covered process areas.
• US OSHA interpretation: Facility entry control — clarification on controlling entrance, presence, and exit of contractors and support personnel in covered process areas.
• CISA: Cyber Security Evaluation Tool—Catalog of Recommendations — recommendations on physical access authorization, access-device inventories, centrally managed systems, and communication-loss testing.
• CISA: Industrial control systems recommended practices — a collection of current resources for control-system security and resilience.