Access control systems fall into two parallel taxonomies: logical access models (MAC, DAC, RBAC, ABAC, rule-based) that govern who gets permission to digital resources, and physical access control systems (PACS) that gate doors, gates, and turnstiles with card, biometric, or keypad hardware [S1][S2][S5].
The three most-cited logical models in 2025 and 2026 enterprise guides are Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Role-Based Access Control (RBAC), with Attribute-Based Access Control (ABAC) added as a fourth mainstream option in 2026 references [S1][S3][S9]. Selection is driven by data sensitivity, regulatory regime, and the number of distinct user roles the system must support, not by feature count [S3][S4].
Logical Access Models: MAC, DAC, RBAC, ABAC, and Rule-Based
Mandatory Access Control (MAC) is the most restrictive of the three classical models: a central authority assigns security labels, and end users cannot change permissions, which is why it appears most often in military, government, and SELinux deployments [S1][S2].
Discretionary Access Control (DAC) hands permission control back to the resource owner, making it flexible but less secure; it is common on personal computers and small workgroup systems where a single administrator owns most files [S1][S2].
Role-Based Access Control (RBAC) ties permissions to job functions instead of identities, so adding a new "HR Analyst" inherits the same rights as every other HR Analyst, which simplifies large-scale permission management and reduces human error [S2][S3].
Attribute-Based Access Control (ABAC) evaluates multiple attributes (user role, device posture, time, location) against policy at decision time, which is why it is the dominant model in cloud and zero-trust architectures discussed in 2026 references [S2][S3].
Rule-Based Access Control (Ru-BAC) layers predefined conditions, most often time-of-day or context rules, on top of another model; a typical example is restricting student lab access to scheduled class hours [S2][S9].
Physical Access Control Hardware: Card, Biometric, Keypad, and Wireless
Physical Access Control Systems (PACS) combine four building blocks: a credential reader, a door controller, an electric lock, and a position or request-to-exit sensor, with audit logging handled by the management software [S2][S4].
Card-based access control is the most common PACS deployment, using key fobs, smart cards, or mobile credentials; lost or stolen cards can be deactivated in seconds without rekeying a door [S5].
Biometric access control verifies fingerprints, iris patterns, or facial geometry, which removes the "something you have" credential from the chain but raises unit cost and demands careful enrollment workflows [S5].
Keypad access control authenticates via PIN and is the lowest-cost reader option, but it suffers from shoulder-surfing and shared-code risk, which is why it is usually paired with another factor in regulated facilities [S2][S5].
System Architecture: On-Premise, Hosted, and Managed
Beyond the logical model, enterprise guides in 2021 and 2026 split the deployment architecture into three categories: on-premise, hosted, and managed access control [S4][S7].
On-premise systems are installed locally and administered by in-house security or IT staff, which gives the operator full ownership of credentials and logs but raises the operational burden for multi-site rollouts [S4][S7].
Hosted and cloud-based systems push the management software to a vendor or partner data center, so administrators can update schedules, issue cards, and pull reports across multiple buildings from a single console [S4][S7].
Managed access control goes a step further: an outside vendor handles day-to-day administration (card issuance, schedule changes, alarm response) under an SLA, which is the model most often chosen by sites without a dedicated security operations team [S7].
Compliance and Standards That Bind the Selection
Specifying access control hardware in a U.S. commercial build means aligning with UL 294 for the readers and controllers, ADA for hardware mounting and door-operating force, and NFPA 101 (Life Safety Code) for egress requirements such as request-to-exit and free-egress hardware [S4].
For logical models, regulators point at frameworks rather than naming MAC vs. RBAC: the U.S. NIST SP 800-53 access control family and ISO/IEC 27001 Annex A.9 are the most commonly cited references for documenting which model an enterprise has chosen and why [S1][S3].
Audit logging is non-negotiable across all of the above: a compliant PACS records every authentication attempt (success or failure) with timestamp, user ID, and door identifier, and retains that log long enough to support the audit cycle of the regulated business [S2][S4].
Model Comparison: Picking the Right Logical Model
Selection reduces to four decision criteria: how centralized permission authority must be, how many distinct roles exist, how dynamic the access decision is, and how much audit overhead the regulator imposes [S3][S9].
MAC wins on confidentiality and tamper resistance but loses on operational agility, since every change needs a central authority, so it stays in government and military enclaves [S1][S2].
RBAC is the best fit when an organization has well-defined job functions and low-to-moderate role churn, which is why it is the default for hospitals, universities, and most enterprise IT directories [S2][S3].
ABAC is the right answer when access must depend on attributes the directory does not know in advance (device health, geofence, time of day, data classification), and the trade-off is policy-engine complexity and higher per-decision latency [S2][S3].
For shops that already run RBAC and need a quick win on shared doors or vendor areas, layering Rule-Based Access Control on top gives time-window control without re-architecting the role catalog [S2][S9].
Hardware Trade-Offs and Failure Modes
Card readers fail in predictable ways: Wiegand readers degrade over cable runs past 150 m, and 125 kHz prox cards are vulnerable to cloning, which is the main reason 13.56 MHz contactless smart cards (MIFARE DESFire, iCLASS) have displaced legacy prox in new installs [S5].
Biometric readers introduce a different failure mode: false reject rates climb when fingers are wet, gloved, or dirty, and facial recognition accuracy drops with backlit or masked faces, so most enterprise PACS designs pair biometrics with a card fallback rather than running them as the sole factor [S2][S5].
Door controller and lock power budgeting is a frequent spec error: a standard electrified mortise lock draws 0.5-1.0 A at 24 VDC inrush, so a four-door panel needs a supply sized for at least 1.25x the locked-load current, with battery backup rated for the local AHJ-required standby hours [S2][S4].
Where Access Control Sits Next to Other Building Systems
Access control rarely stands alone on a job site: it shares conduit, power, and head-end room with video surveillance, intrusion detection, and intercoms, which is why spec-first planning tools lay out the door schedule, reader count, and cable runs before any hardware order is cut [S4].
On sites where the security model is layered, access control pairs with perimeter alarms to detect the breach and with the physical egress hardware to keep the door schedule legal under fire code; the access control vs. perimeter alarm spec map walks through that joint decision tree.
For workers who maintain credentialed doors inside a regulated plant, the same safety stack that drives respirator fit-class specs and toxic gas detector placement ends at the access-controlled door, so PACS design should be drawn from the same hazard register as PPE and gas-detection layouts.
Signals to Track Next
Two trackable signals will reshape 2026-2027 access control specs: the rate at which mobile credentials (BLE/NFC wallets) displace physical cards in new PACS tenders, and the publication of updated UL 294 and NIST SP 800-53 control baselines that codify zero-trust ABAC patterns. [S5]
Buyers who want a defensible 2026 shortlist should pin the logical model (RBAC vs ABAC) to a documented risk assessment, the credential technology (mobile vs card vs biometric) to a threat model that names cloning and relay attacks, and the deployment architecture (on-prem vs hosted vs managed) to the in-house headcount available to run it.
Detailed specification references: access control, access scaffold, and haulage access vehicle.