Ask whoever administers your access control system how many access levels the system contains. Almost nobody can answer from memory. So open the software and count.
In a building running a few years, the list scrolls. There will be entries named after people who left, several differing by a single word — Office, Office 2, Office (new), Office night — and at least one called Temp, created for a reason nobody can state, still assigned to somebody.
That list is the actual security policy of your building. Not the document in the binder — the list. It is what the controller consults, in milliseconds, every time somebody presents a credential at a door, and in most buildings nobody has ever read it top to bottom.
The underlying idea is almost insultingly simple. The sprawl is not caused by complexity. It is caused by one habit, repeated under time pressure, for years.
What an access level actually is
An access level is a pairing of two lists.
The first list is doors — which openings this level covers. The second is time — a schedule saying when that door set is live. Everything else in the system is bookkeeping around those two lists.
When somebody taps a credential, the controller asks two questions, and only two. Is this credential attached to a level that contains this door? And is right now inside the schedule attached to that level? Two yeses release the lock. Anything else is a denial, written to the log with a reason.
That is the whole mechanism. If access control software feels more complicated than it needs to be, it is because most products let you express those same two lists in five different places — door groups, area groups, reader groups, time zones, per-cardholder overrides — and a building that uses all five ends up unable to say what any given person can open.
The rule that fixes this is the pair of questions the controller is already asking. For any access level in your system, you should be able to say: which doors, and at what times. If you cannot answer both from the level's name and a single screen, the level is not a policy. It is a residue.
And there is a third test, which does the real work.
The one-phrase role test
If you cannot name the role an access level serves in one short phrase, it should not exist.
Cleaning contractor, nights. Day staff, main floor. Building operations, all doors, all hours. Front desk, business hours. Tenant, third floor. Those are roles. They describe a job somebody does, they still make sense after every current employee has moved on, and they can be handed to a new administrator with no explanation.
Now the failing cases, all of them ordinary patterns in ordinary BC buildings: Marco nights. Level 7. Copy of Office. Copy of Copy of Office. Temp. Do not delete.
Every one of those names is a confession. Marco nights says the level was built around a person rather than a job. Level 7 says nobody would commit to what it is for. Copy of Copy of Office says two people needed a small variation and nobody had a mechanism for that. Do not delete says somebody once tried, something broke, and the fix was a warning label rather than a diagnosis.
A level named for a role can be audited by anyone. A level named for a person can only be audited by asking that person — and an access level should outlive whoever currently holds it.
How the sprawl happens
Nobody sets out to build forty access levels. Sprawl accumulates one defensible decision at a time.
A cleaning contractor starts tonight. They need the loading bay, the second floor, the janitorial room and the stairwell, from 21:00. The administrator is between meetings. Building a proper role-based level means thinking about door groups, schedules, and what the next cleaner will need. Creating one level right now, named after the person in front of them, takes ninety seconds.
The second contractor arrives months later. The first level almost fits, but this one also needs the parkade. Nobody wants to edit the existing level, because that would change what the first contractor can open and nobody is certain that is safe. So they copy it, add the parkade, and rename the copy.
That is the whole disease. It is not carelessness. It is a rational response to a system where editing feels risky and copying feels free.
Then levels stop being deleted. When somebody leaves, the credential gets disabled — that part usually happens — but the level built for them stays, because deleting things in an access control system is exactly what nobody wants to have been the last person to touch. Within a few years the list holds more levels than the building has distinct jobs.
At that point the system is technically working and functionally unauditable. Ask "who can get into the server room after hours" and the honest answer requires cross-referencing every level against a door list by hand. So nobody asks — and a question nobody asks has no answer, which is a different thing from a safe answer.
Why "just copy Dave's access" is the worst habit in the trade
Every building has a Dave. Dave has been there longer than anyone, he is helpful, and his access works everywhere. So when somebody new starts in roughly Dave's area, the instruction that comes down is: just copy Dave's access.
It is the fastest possible way to get a new person working, and it is the single most damaging thing you can do to an access control system. Three reasons, in order of severity.
It copies an accumulation, not a role. Dave's access is not a description of Dave's job. It is an archaeological record of every job Dave has ever held in that building, plus every one-off exception ever granted to him — the week he covered for maintenance, the project where he needed the roof, the quarter he helped in shipping. None of it was ever removed, because nothing ever is. Copying Dave hands a brand-new employee years of accumulated exceptions on their first morning.
It transfers access with no reason attached. A copy carries the doors but not the why. Later, somebody reviewing the system finds a junior employee with access to the electrical room and asks why. The answer is "they were copied from Dave," which is not a reason, it is a lineage. Access with no stated reason is access nobody can confidently revoke, because revoking it might break something and nobody knows what. This is how a building arrives at a state where every level is untouchable.
It compounds into near-duplicates. The next person gets copied from the copy. And the moment one of them needs one extra door, you have two levels identical except for a single opening, with no way to tell from either name which is which.
The alternative costs a few extra minutes and is the entire difference between a system you can audit and one you cannot: identify the role the new person occupies and assign the level that already exists for it. If none exists, that is worth knowing — and worth the few minutes to build one properly, named for the role, so the next hire takes ninety seconds and does no damage.
The clean design
A well-built access system is smaller than people expect.
Group the doors once. Define door groups that mean something in the building — main floor perimeter, parkade, mechanical spaces, third floor tenant suite. Levels then reference groups rather than individual doors, so adding a door to the parkade is one edit instead of forty.
Define the schedules once. Business hours, extended hours, nights, around the clock. Most buildings genuinely need only a handful, and every level that says "nights" should point at the same "nights", so changing when nights start is one edit.
Make levels the pairing, and name them for the role. Cleaning contractor — nights. Day staff — main floor. Building operations — unrestricted. A new administrator should be able to read the level list and describe the building's staffing model from it. That is the test.
Use additive assignment as the release valve. This is the mechanism whose absence causes sprawl. When one person needs a role level plus one extra area, do not clone the role level — assign a second, small level covering only the extra. Most systems allow multiple levels per cardholder and take the union. The exception is then visible as an exception, listable on its own, and removable without touching anybody's core access.
Give every level an owner. A named person who can say why the level exists. A level whose owner has left the organization is the first thing to examine in any audit.
Groups, schedules, role levels, additive exceptions, an owner per level. A mid-size commercial building or strata rarely needs more distinct roles than fit on one page.
Getting from sprawl back to clean without locking anybody out
This is the part that stops people, reasonably. The nightmare is straightforward: you tidy up on Friday and on Monday somebody cannot reach their floor, or a contractor is stranded in a parkade at 04:00. That fear is why the messy list survives for years.
The way through is to make the migration purely additive until the very end. Nobody loses anything until you have watched the replacement work.
Export what exists, and read it on paper. Every level, its door set, its schedule, and who holds it. Most systems will produce this; if yours will not, that is itself a finding.
Sort by door set, not by name. Names lie; door sets do not. Sorting by what each level actually opens makes the duplicate clusters obvious — clumps of levels covering identical or nearly identical openings under different names.
Draft the target list of role levels. Do this from the building's actual jobs, not from the existing levels. Write the one-phrase role name first, then the door group, then the schedule. If a role will not fit that shape, keep interrogating it — usually it is two roles wearing a trench coat.
Build the new levels alongside the old ones and assign them in addition. At this point everybody holds both their legacy level and their new role level. Nothing has been taken away. Nothing can break.
Wait through a full cycle. Long enough to cover the building's monthly and quarterly rhythms — after-hours cleaning, the elevator service visit, the fire inspection, the quarter-end weekend. This is where you learn that the loading bay is used by somebody nobody remembered.
Then remove the legacy levels in small batches, watching the denial log. Denials are the whole safety net. A wrongly stripped permission shows up as a denied read at a specific door, by a specific credential, at a specific time — telling you exactly what to restore and to whom. Batches rather than a single sweep keep that signal readable. We cover the reports worth running in the four reports your access control system should be producing.
Close the door behind you. After cutover, adopt the rule as policy: no level is created unless somebody can state which doors, at what times, and the role it serves in one phrase. Exceptions become additive assignments with a review date, not clones.
The short version
An access level is which doors, paired with when. That is all it has ever been. Buildings lose control of their access systems not through complexity but through one habit — creating levels for people instead of roles, usually by copying somebody else's — repeated under time pressure until the list is too tangled for anyone to touch.
The cure is three questions asked before any level is created: which doors, at what times, and what role does this serve. If the third answer is a person's name, you are not writing policy. You are recording somebody's history, and history is the one thing an access control system should never be enforcing at your doors.
The natural next step is walking your building for least privilege, which turns a clean level list into decisions about who genuinely needs what.
