Every mobile credential rollout that stalls, stalls on something that was already true before the first phone was enrolled. Five conditions worth checking before you start, and what each one costs if you skip it.
By Nick Venuti, Senior Director of Product Marketing · 6 min read
A mobile credential rollout is the most visible thing a building can do with access control and the easiest part of it to buy. The credential works. The readers are ready. The enrollment on the phone is a solved problem. What decides whether the program lands is a set of conditions that were already true, or already false, on the day somebody signed the order, and none of them have anything to do with the phone.
Why the credential is the easy part
Issuing a credential is a decision with four parts. Who should hold one. Which doors it opens. Which floors it reaches. What makes it stop. The credential technology answers none of those. It carries the answer somebody else produced, and it carries a wrong answer exactly as faithfully as a right one.
That is why a building with a tidy identity layer can switch mobile on in weeks, and a building without one can spend a year at it and still have a security desk printing cards. The difference was decided before either of them started.
- One authoritative record per population
- Joiners and leavers both visible to the building
- Start and end dates that mean something
- Resolves one person across systems that hold them differently
- Turns role and location into doors, floors and hours
- Writes into each access control system in its own terms
- Withdraws everything on a single event
- Mobile, card, or both during the overlap
- Issued by the event that should issue it
- Revoked without anything to collect
Buildings that buy the third without the first two are buying a faster way to distribute a decision nobody is maintaining.
What a mobile credential rollout actually needs
Two halves, and the elevator half is the one most often discovered late, usually by somebody standing in a lobby holding a phone that opened the turnstile and will not call a car.
A credential that opens the lobby and stops there has solved the easy half of the journey. Floor authorization has to derive from the same groups that drive door access, or the elevator estate becomes a second population to maintain and a second thing to forget on a leaver.
- 10+ elevator manufacturers integrated
- Destination dispatch and traditional hall-call alike
- Floor rights derived, never maintained separately
- A move between floors is an attribute change
- Revocation reaches doors and floors on one event
Where braXos has the deepest bench. 10+ years of vertical access across multi-tower portfolios.
A credential issued by hand is issued rarely, and a credential revoked by hand is revoked late. Both halves have to run off the event that should drive them, which means the building has to be able to see that event in the first place.
- Issued by a hire date, a lease entitlement or a booked visit
- Activation and expiration carried on the record
- Revocation propagates without collecting anything
- Exceptions handled by an attribute, not a side process
- Provisioning activity recorded with a timestamp, source and change detail
The same layer reaches everything else. 200+ pre-built connectors, 50+ of them for access control.
Five things worth checking before you start
Reconcile first, connect the sources second, switch on mobile third. Each of the five below is something to establish before that third step is worth taking.
If somebody has four records in four buildings, mobile gives you four phone credentials to chase instead of four cards. Resolving the person first is what makes the rest cheap.
This is the one that quietly fails in multi-tenant property, because the tenant has no reason to report a departure and the building has no way to see one. What collects in that gap is worth measuring before you add phones to it.
If the elevator group keeps its own list, you have two revocation processes and only one of them will run.
Small tenants, contractors, vendors. A scoped portal covers them without an integration project, and they are usually the majority.
Compare what the access control system holds against what each source says is current. That comparison is a short exercise and it is the only honest baseline for anything that follows.
Four ways a rollout comes unstuck
Mobile goes live on the doors because the door system was the project. The elevator interface was a separate line item that slipped, so every holder still badges at the turnstile and then waits for somebody to call a car for them.
The flagship building runs the new platform and the rest of the portfolio does not. Mobile works where the executives sit and nowhere else, which is the most expensive possible place for a pilot to stop.
Mobile is available but the fastest route to working access is still the security desk, because that is the only path anybody has automated. Plastic stays in circulation and the program is quietly judged a disappointment.
Revocation was never wired to the record that knows people leave. The organization now has the same gap it had with cards, except there is nothing to hand back at the door and no visible prompt that anything is outstanding.
Integration detail
Nobody has ever had a mobile credential program fail because the phone did not work. They fail because the building could not answer who should have one, and could not tell when that stopped being true.
Part of a wider ecosystem
The identity work that makes mobile practical is the same work that makes everything else practical. Visitor management, parking, room and desk reservation, secure print release and smart vending all ask the same question about the same person, and once it is answered properly each of them becomes configuration against a connector library rather than another project. Mobile is simply the most visible thing to do with an answer you already have.
Find out which of the five you already have
A reconciliation against your current sources is a short exercise and the only honest baseline for a mobile program. Talk to us about running one, or browse the connector library to see what is already built for your systems.
Talk to us about readinessMore on the platform in the braXos connector library, or see the rest of the Symphony Series.
Visit us at www.braXos.com | [email protected]
