Topic starter
17/08/2026 4:38 pm
TL;DR: The University of Ottawa says it unified physical and digital access control in one identity system, adding RBAC, lifecycle management, and direct integration between Genetec and Saviynt to streamline campus access and governance. The practical lesson is that physical security becomes an identity lifecycle problem once badges, roles, and approvals share the same control plane.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Saviynt ChangeMakers: How the University of Ottawa Integrated Digital and Physical Access Control Systems—A First in Higher Ed”.
Key questions
Q: How should security teams govern physical and digital access through one identity model?
A: Start by mapping badges, facility rights, contractor credentials, and application entitlements to a single identity record.
Q: Why does RBAC help when campus access spans buildings and IT systems?
A: RBAC reduces one-off access decisions by linking access to defined roles rather than individual doors or accounts.
Q: What happens when physical access and digital access are managed separately?
A: Separate control planes usually produce policy gaps, slower provisioning, and inconsistent recovery when a badge or credential is lost.
Practitioner guidance
- Unify physical and digital access governance Map badge access, building permissions, and IT entitlements into a single identity model so role changes propagate through one approval path rather than parallel processes.
- Apply RBAC to campus access decisions Define role sets for common university functions and use them to drive both physical and digital access assignments instead of handling each door or account separately.
- Connect lifecycle events to access revocation Tie joiner, mover, and leaver events to badge credentials, group memberships, and application access so offboarding and role changes are handled together.
Bottom line: The core issue is not a badge system upgrade but the governance problem of keeping physical and digital access aligned through one identity lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:44 pm
Physical access is now an identity governance domain, not a facilities exception. The University of Ottawa case shows that badge issuance, building access, and digital entitlements can be governed through the same identity model when organisations are willing to treat physical access as lifecycle-managed entitlement. That collapses a long-standing split between facilities operations and IAM. The practical conclusion is that access governance programmes should stop assuming physical access sits outside identity architecture.
A question worth separating out:
Q: How can teams tell whether access governance is actually working?
A: Look for short revocation times, low rates of stale entitlements, and repeatable access review outcomes across systems. If accounts remain active after role changes or offboarding, governance is not effective. Good measurement focuses on whether access is removed when it stops being justified.
👉 Read our full editorial: University of Ottawa unifies physical and digital access with IGA