Identity-driven provisioning
Access rights derive from who someone is and which roles they hold in the IAM system, not from who happened to ask at the desk.
Origins
Why the category exists
For decades, digital and physical access grew up as separate worlds with separate owners. IT built identity governance: joiner, mover and leaver processes, role models, approval workflows, recertification, audit trails. Facilities managed keys: issue registers, key cabinets, deposit forms, and a great deal of institutional memory.
That separation was tolerable while keys were purely mechanical and expectations were low. Three developments ended it.
The distinction
Authentication is not governance
A lock authenticates a key. A reader authenticates a badge. Both answer one question: is this credential valid at this door, right now? Neither knows whether the person holding it should still have it.
Governance answers the questions that come before and after. Access control enforces. Governance decides and evidences. An organisation can have excellent locks and no governance at all, and most do.
- 1Is this key valid at this door, right now?The only question a cylinder can answer.
- 2Should this person hold this right?Derived from role, contract and lifecycle state.
- 3Who approved it, against which policy?Recorded in the same IGA that approves digital access.
- 4When does it end?With the contract, the role change, or the leaver event.
- 5Can we prove all of it later?Every grant, change and revocation, traceable to an identity.
The lock is right. Anna's key is valid. Nobody has asked whether it should be.
Anatomy
What physical access governance consists of
Four capabilities, implemented as middleware between the IAM system and the locking system, translating identity decisions into access rights in near real time.
Policy and approval
Which role opens which doors is defined once, as policy. Exceptions pass through approval instead of around it, in your own IGA.
Lifecycle enforcement
Joiners receive access with their role, movers lose the old and gain the new, and leavers lose everything in the same movement that disables their accounts. Contract end dates end physical access too.
Audit and evidence
Every grant, change and revocation is logged, tamper-evident, and traceable to an identity and a decision, so compliance questions are answered from the system.
The principle
One identity, two worlds
A person has one identity. Their digital access is derived from it: role, department, contract dates, lifecycle state. Their physical access should be derived from the same identity, not from a second record kept by facilities, a key register, or a badge system with its own copy of who works here.
When the identity changes, both worlds should change in the same movement. A contract that ends on Friday ends the VPN and the substation key on Friday.
One event. Six revocations. Same movement.
Adjacent categories
How it differs
The categories are complementary. Most critical entities run several of them. Physical access governance is the layer that makes the key-operated estate as governable as the badge-operated and digital parts. Hover a row.
Category
Digital applications
Badge-controlled doors
Key-operated sites, offline
IAM / identity governance
Governs
No reach
No reach
Electronic access control (PACS)
No reach
Enforces
No reach
PIAM (physical identity and access management)
Syncs from
Governs
No reach
Key management software
No reach
No reach
Registers
Physical access governance
Connects to
Connects to
Governs
Hover a category to see what it does and where it stops.
Governs or enforcesPartial: registers or syncsConnects toNo reach
The badge estate and the rest
Where PIAM stops
PIAM was built for the badge estate: office buildings, wired doors, a reader on every entrance. It does that well, and physical access governance connects to it. Two things sit outside its reach.
The estate is the wrong shape. A utility's risk lives in substations, cabinets and pumping stations, thousands of sites with no reader and no network, where a key is the entire security model.
The decision has to come from one place. Physical access governance does not keep its own copy of the identity. It makes the IAM the source of every decision and treats the lock as one more system that carries it out.
Mechanics
Offline assets
Most operational sites are offline by design. Keys and cylinders stay disconnected for resilience, and governance has to work there anyway. With programmable keys, it does.
Rights travel with the key and are refreshed when the key is used. Revocation is therefore near real time, not instantaneous: the window is closed by periodic blacklist checks the customer configures, and a shorter interval costs battery. The audit trail is collected when keys and cylinders sync. The site never needs connectivity.
1Control plane, online
The decision
A role changes, a contract ends, an approval lands in the IGA. The right is granted or withdrawn in the control plane.
2Key, on use
The key carries it
The next time the key is used it picks up its updated rights. Revocation propagates the same way, and through a scheduled blacklist check.
3Cylinder, offline
The lock enforces it
The cylinder never needs a network. It checks the rights the key presents, and the blacklist it holds, and opens or refuses.
4Control plane, on sync
Evidence comes back
Every open, refusal and update is collected when keys and cylinders sync, and linked to the identity and the decision that caused it.
More oftenLess often
A design choice the customer makes per estate, not a limitation to hide.
Exposure window after a revocation
Battery life of the key
Industries
Who needs it
Physical access governance matters most where physical access affects safety, continuity or compliance. The common trigger is regulatory: organisations in scope of NIS2 or CER discover that their digital governance is mature while their physical access is still administered by hand, and that auditors have started asking about both.
UtilitiesThousands of dispersed, unmanned sites where the key is the entire security model.Utilities →GovernmentDiverse estates, many external hands, public accountability under NIS2.Government →TransportSafety-critical trackside and depot access with layered contracting.Transport →TelecomMasts, exchanges and street cabinets: digital infrastructure with subcontracted hands.Telecom →Water managementPump stations, sluices and weirs across the polder, unmanned by design.Water management →
Self-assessment
The governance gap
Most critical entities today run mature identity governance on the digital side and capable locking technology on the physical side. What is missing is the connection between them: the point where an identity decision becomes an access right, automatically and with evidence. That is the governance gap, and it is narrower than most organisations think.
Pick the stage that looks like yours.
Joiner
Mover
Leaver
Audit
Stage 1. The register is only as good as the discipline behind it, and discipline decays continuously.
Stage 2. Better registration, same decisions. Every grant and revocation still originates outside the identity lifecycle. Most organisations are here or at stage 3.
Stage 3. Capable systems on both sides, and nothing connecting them. This is the governance gap, and it is one integration wide.
Stage 4. Governed. Nobody has to remember anything.
The thesis
The identity control plane
Over the last decade the IAM system became the control plane for digital access: one place where lifecycle, policy, certification and audit are defined, and every application is an enforcement point. Physical access is the last domain still outside it.
Physical access governance extends the control plane. The same joiner, mover and leaver events, the same approval flows, the same recertification campaigns and the same audit trail now reach the substation door. The lock becomes what an application already is: something that enforces a decision it did not make. Approvals stay in your IGA. No decision originates anywhere else.
Identity decides.
Who may hold access is derived from the identity in the IAM you already run.
Policy governs.
The same approvals, segregation rules and certification cycles that govern digital access.
Technology executes.
Keys and cylinders carry out what was decided. They enforce. They never decide.
Analyst view · KuppingerCole Analysts, 2026
What KuppingerCole says about the category
KuppingerCole Analysts, Rising Star report on Key2XS, September 2026“Physical Access Governance extends identity governance to the offline, mechanical, and electronic key systems protecting critical field assets such as substations, pumping stations, and bridges.”
“Physical Access Governance is likely to grow steadily in the next two to three years, tracking the pace at which the CER Directive and NIS2 are transposed into national law and enforced.”
Key2XS named a Rising Star 2026 by KuppingerCole Analysts
Market segment: Physical Access Governance
Read the analyst recognition
Evaluation
A buyer's checklist
When evaluating a physical access governance solution, ask these. Tick what a vendor can show you, not what they tell you.
0 of 8 shown
Key2XS answers these by design: certified integrations on both sides, pre-built connectors for SailPoint, Entra ID, Okta, One Identity and OpenText and for iLOQ and the ASSA ABLOY CLIQ ecosystem, approvals that stay in your IGA, near real-time propagation with configurable blacklist checks, a tamper-evident audit trail, and standard integrations live in under two hours.
Frequently asked questions
Physical access governance, defined and explained.
Managing physical keys and lock permissions through identity-driven controls: rights derived from roles, revoked automatically with the identity lifecycle, and evidenced in an audit trail linked to the identity.
Access control enforces access at the door, whether by badge, key or code. Governance decides and proves who should have that access in the first place, based on identity, role and policy, and withdraws it when the reason ends.
PIAM manages badge holders for reader-controlled doors and keeps its own identity records, synchronised from HR or IAM. Physical access governance connects to PIAM and to the IAM, makes the IAM the source of every physical right, and reaches the key-operated, offline estate that badges never covered.
Yes. Rights travel with programmable keys and are refreshed when the key is used. Revocation is enforced at the next use and by periodic blacklist checks, and the audit trail is collected when keys and cylinders sync. The site needs no connectivity.
Both directives require governed, demonstrable control over physical access to premises and infrastructure. Neither prescribes a specific technology, but manual key administration cannot produce the evidence they ask for.
No. Physical access governance is a middleware layer. It connects the IAM system and the digital locking system you already run.
Key2XS is a physical access governance platform: a governance control plane connecting IAM systems (SailPoint, Microsoft Entra ID, Okta, One Identity, OpenText) to electronic key systems (iLOQ, ASSA ABLOY CLIQ), vendor-neutral in any combination.