Systems and methods of operating a secured facility

A method of providing security operations in a secured facility in which access control operations are performed, wherein the secured facility includes a plurality of access control units physically distributed at different physical locations within the secured facility, the method comprising:

• providing access control cards to users who are granted access to respective portions of the secured facility;
• defining a topology of event sequences within the secured facility using software executed on one or more processor-based systems, wherein the topology includes a plurality of nodes and edges between ones of the plurality of nodes;
• defining access control policies that define conditions for access for the users through access control units in the secured facility;
• controlling access operations within the secured facility according to the defined access control policies;
• generating first data reflective of user actions of multiple users within the secured facility that are authorized according to the defined access control policies;
• processing the first data, by software executed on one or more processor based systems, against the defined topology to define second data that is reflective of role-based user norms within the secured facility across respective event sequences within the secured facility, wherein at least some of the event sequences include at least three event nodes;
• and
• processing substantially real-time event data, by software executed on one or more processor based systems, against the second data to identify current activity of users within the secured facility as anomalous user activity for increased security inspection.