A framework for access provisioning in physical access control systems

A physical access control system (PACS) with a framework for access provisioning, the physical access control system comprising:

• a user, the user having a credential including user information stored thereon, the user presenting the credential to request access to a resource protected by a door;
• a reader in operative communication with the credential and configured to read user information from the credential;
• a controller executing a set of access control permissions for permitting access of the user to the resource, the permissions generated with a framework for access provisioning, the framework comprising:
• a permissions request interface, the permissions request interface configured to permit a user or an administrator to provide a request for a permission to access/revoke access to a resource in the PACS;
• a permissions recommendation module, the permissions recommendation module in operable communication with the permissions request interface to receive the request, the permissions recommendation module recommending a permission to be assigned to, or removed from, the user based on at least one of an attribute presented by the user, a static permission assigned to other users, and a used permission of other users;
• a permissions validation module in operable communication with the permissions recommendation module, the permission validation module operable to ensure that at least one of the permission to be assigned to or to be removed from the user does not violate an existing access control policy, that the permission to be assigned to the user is sufficient for reaching all permitted resources, and that the permission to be removed from the user denies access to all revoked resources;
• and
• an approval workflow identification module operably connected to the permission validation module, the approval workflow identification module identifying an approval required to assign or remove the permission,
• wherein the controller is disposed at the door to permit access to the resource via the door.

A method of access provisioning in a physical access control system (PACS), the method comprising:

• a receiving a request from at least one of a user and an administrator to provide a permission to access or revoke a permission access to a resource in the PACS;
• recommending a permission to be assigned to, or removed from, the user based on at least one of an attribute presented by the user, a static permission assigned to other users, and a used permission of other users;
• validating that at least one of, the permission to be assigned to or to be removed from the user does not violate an existing access control policy, that the permission to be assigned to the user is sufficient for reaching all permitted resources, and that the permission to be removed from the user denies access to all revoked resources;
• and
• identifying an approval required to assign or remove the permission.