TL;DR: Face recognition used for workplace access sits at the intersection of biometric verification, GDPR special-category data, and AI Act carve-outs, with necessity, fallback access and template custody determining legality and risk, according to Crayonic. The control problem is not the face itself but whether the identity check is proportionate, auditable and backed by hardened device administration.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Crayonic's blog post: Face recognition at workplace doors creates a governance problem around biometric necessity, template custody and hardened device administration, not just access convenience.
Why it matters: Identity, IAM and privacy teams need to treat biometric access as a governed control decision because legality, fallback paths and device hardening determine whether it is defensible.
By the numbers:
- The company had clocked its 128 staff in and out with facial recognition terminals.
Context
Biometric access control is only defensible when the system proves necessity, protects the biometric template and offers a fallback for people who cannot or will not use the same method. The problem is broader than doors: once a face becomes an access credential, privacy law, device security and identity governance all apply at once.
Crayonic's example shows how weak administration can undermine even a lawful use case. A system that is marketed as secure but still uses a default admin password is not a biometric governance success, it is an access control failure with identity data attached.
Key questions
Q: How should organisations govern facial recognition so it remains defensible?
A: Treat facial recognition as a governed identity control, not a standalone AI output. Start with a written policy that defines necessity, proportionality, and approved use cases, then enforce human review, threshold oversight, and ongoing performance testing. The system should be accountable end to end, from data quality to final decision.
Q: Why does biometric verification reduce access risk compared with badge-based entry systems?
A: Biometric verification reduces access risk because it confirms that the person presenting for entry is the authorised individual, not just someone holding a credential. A badge can be loaned, copied, or stolen, which weakens assurance. Biometrics make the face or fingerprint the credential itself, creating a stronger link between identity and access decision in physical security environments.
Q: What are the signs that facial recognition access control is failing?
A: Warning signs include default credentials on the terminal, no documented fallback, no recent privacy impact assessment, vague template storage arrangements and staff using the system without clear consent or legal basis. If the system cannot show who manages the sensor, the template and the exception path, it is already outside good governance.
Q: What should security teams do if a biometric access device is deployed with weak administration?
A: Treat it as an access-control incident, not just a device hygiene issue. Isolate the terminal, remove default credentials, review management access, check whether templates or logs were exposed and confirm that the biometric was actually necessary for the use case. Then decide whether the control can be remediated or must be replaced.
Technical breakdown
Biometric verification versus remote identification
Biometric verification checks whether a person matches a previously enrolled identity claim, while remote identification searches for a match across a database without the person's active involvement. That distinction matters because many workplace systems are sold as simple access controls but can drift into broader surveillance if logs or templates are reused for monitoring. In governance terms, the identity proofing question is not only who the person is, but what the system is allowed to do with the biometric after matching. When the same infrastructure supports attendance, premises access and behavioural monitoring, the privacy and trust boundary changes materially. See the Biometric Authentication and Verification Guide.
Practical implication: Treat workplace face recognition as a narrowly scoped verification control unless the programme has explicit legal and governance approval for broader processing.
Why template custody and fallback routes decide legality
A biometric template is not just a technical artefact, because whoever controls the template controls the blast radius of a compromise. Central stores increase exposure, while device-held or cryptographically protected templates reduce the incentive to centralise sensitive identity data. Regulators also care whether people have a usable alternative, because a biometric that becomes the only path into a workplace can become coercive as well as risky. This is where identity governance overlaps with physical access control: the control is only as defensible as the enrolment, storage and exception handling around it.
Practical implication: Define where templates live, who can retrieve them and what non-biometric path exists before deployment.
Sensor trust and administrative hardening
A face reader is only trustworthy if the sensor path is trustworthy, because a compromised camera or terminal can feed false samples into an otherwise sound matching engine. That is why remote authentication logic, presentation attack detection and local comparison all matter. Administrative hardening is part of the same control plane: default passwords, unauthenticated sensors and weak management interfaces turn the device into an entry point rather than a verifier. For identity programmes, the lesson is that biometric assurance fails when device trust and enrolment trust are treated as separate problems.
Practical implication: Require authenticated devices, locked-down administration and tested spoof resistance before relying on biometric access.
Threat narrative
Attacker objective: The objective is to weaken or bypass the access control boundary by exploiting the terminal's administrative weakness rather than the biometric algorithm itself.
- Entry began with a facial recognition terminal deployed as a workplace access control and left running with a default administrator password.
- Escalation would have been straightforward for anyone who could reach the device management interface, because weak administrative control can undermine the integrity of the biometric system itself.
- Impact was the creation of an access control arrangement that could not be defended as a hardened identity control, even before privacy and necessity questions were considered.
Breaches seen in the wild
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Biometric access control fails first as a governance problem, not a model problem. The central question is whether a face is necessary at all for the use case, because legality and proportionality determine whether the control belongs in the design. When a less intrusive method exists, the identity programme has to justify why biometric processing is still warranted. Practitioners should treat necessity as a control requirement, not a policy footnote.
Template custody is the real trust boundary. The article's strongest point is that a biometric system becomes materially safer when the template stays under the person's control or on the person's device, and materially riskier when the operator holds a central store. That is an identity governance issue because the template is effectively a durable authenticator. Teams should align storage design with biometric authentication and verification principles and avoid centralising what can remain local.
Admin hardening belongs in the biometric assurance model. A system can satisfy policy language about verification and still fail operationally if the terminal is left with a manual password or an unauthenticated sensor path. That creates a governance gap between approved use and actual device state. Practitioners should assume the weakest managed device, not the strongest matching algorithm, defines real-world assurance.
Face recognition at the door creates a special kind of shadow trust gap. Staff may assume the biometric is the control, while the actual trust chain depends on device administration, template handling and an exception route. When any of those are missing, the programme has built an identity control that cannot be defended under audit or incident review. The practical conclusion is to govern the full access path, not just the sensor.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: Biometric Authentication and Verification Guide
What this signals
Biometric governance will keep moving from pilot approval to exception management. The practical question is no longer whether a face can match a person, but whether the programme can prove necessity, preserve a fallback path and keep the template out of a centrally exposed store. That is where auditability and legal defensibility will be judged.
Template custody will become the decisive design variable. If the biometric artifact sits on the user's device or under user-controlled encryption, the governance posture is materially different from a central database model. Teams that still treat biometric storage as a back-end implementation detail will find that privacy review, physical access policy and identity assurance are all asking the same question.
Access control cannot be separated from device hardening. A biometric terminal with weak administration creates the same governance problem as any unmanaged privileged endpoint: the control path is trusted more than the control state deserves. Practitioners should therefore track terminal hardening, exception handling and replacement readiness as part of identity programme risk.
For practitioners
- Define the necessity test before deployment Document why a biometric is required for the specific access point and record why badges, cards or other less intrusive options do not meet the use case.
- Map template custody and retention Specify whether templates remain on the user's device or in a central store, who can access them, and how deletion and revocation are handled.
- Enforce authenticated device administration Remove default credentials, require strong admin authentication and verify that every reader or terminal has a protected management path.
- Provide a non-biometric fallback path Ensure every staff member has a usable alternative route that does not depend on facial recognition and does not create an informal exception process.
- Record the assurance evidence Keep the DPIA, the PAD test result, the false match rate commitment and the administrative hardening evidence together for audit and review.
Key takeaways
- Facial recognition at workplace doors raises a governance question about necessity, not just a technology choice.
- The example shows how a biometric control can fail when template custody and device administration are left weak.
- Teams need a documented fallback path, a defensible legal basis and hardened terminal management before treating biometrics as a primary access control.
Related NHI Mgmt Group resources: Biometric Authentication and Verification Guide · Ultimate Guide to NHIs: Key Challenges and Risks · Top 10 NHI Issues
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while GDPR and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art.9 — Special categories of personal data | Facial recognition for staff access processes biometric data used to identify a natural person. |
| Recommendation — Document a lawful basis, perform a DPIA and justify why biometric processing is necessary for the use case. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | The article compares face-based access with NIST's biometric authentication guidance and assurance logic. |
| Recommendation — Use SP 800-63B to validate biometric error rates, PAD and fallback authentication before deployment. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post focuses on controlling access through verified identity and exception handling. |
| Recommendation — Align biometric access decisions with PR.AA-05 by governing entitlements, exceptions and access proofing. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article stresses hardening, fallback and administrative control of the biometric terminal. |
| Recommendation — Apply IA-5 to manage credentials, device administration and authenticator lifecycle for biometric terminals. | ||
| ISO/IEC 27001:2022 | A.8.2 — Privileged Access Rights | The default admin password and terminal management problem make privileged access rights central to the risk. |
| Recommendation — Restrict and review privileged access to biometric terminals under A.8.2 and remove default administrative credentials. | ||
Key terms
- Biometric Verification: Biometric verification confirms a person’s identity by matching live physical or behavioral traits, such as a face, fingerprint, voice, or iris, against a previously enrolled reference. In IAM, it is an authentication method that can support step-up access, but requires strong liveness checks, spoof resistance, and privacy controls.
- Real-Time Remote Biometric Identification: A biometric identification method that captures, compares, and identifies a person almost instantly at a distance, typically in public settings. In the EU AI Act, this is a tightly restricted practice because it can enable pervasive surveillance, chill public freedoms, and produce harmful errors or biased targeting.
- Template Custody: The control question of where a biometric template lives, who can access it and whether the person or the operator holds the key. Custody drives the breach blast radius, the legal posture and the practical trust model of the entire access control system.
- Presentation Attack Detection (PAD): Presentation Attack Detection (PAD) is the set of checks used by biometric systems to tell a live person from a fake or replayed presentation, such as a photo, mask, video, or synthetic sample. Defenders assess PAD strength, failure handling, and bypass resistance, because weak PAD lets impersonation succeed.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It gives practitioners a structured way to connect identity controls to operational and audit requirements.
Published by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org