Notifications
Clear all
Topic starter
17/08/2026 4:38 pm
TL;DR: The University of Ottawa says it unified physical and digital access control in one identity system, adding RBAC, lifecycle management, and direct integration between Genetec and Saviynt to streamline campus access and governance. The practical lesson is that physical security becomes an identity lifecycle problem once badges, roles, and approvals share the same control plane.
NHIMG editorial — based on content published by Saviynt: University of Ottawa integrated digital and physical access control systems
Questions worth separating out
Q: How should security teams govern physical and digital access through one identity model?
A: Start by mapping badges, facility rights, contractor credentials, and application entitlements to a single identity record.
Q: Why does RBAC matter in physical access control?
A: RBAC matters because it replaces ad hoc, door-by-door permissions with governed roles that can be reviewed, approved, and revoked consistently.
Q: Why does physical access become risky when it is managed separately from IAM?
A: Because physical access can outlive the employment record if revocation is not tied to the same source of truth.
Practitioner guidance
- Map physical access into the same lifecycle workflow Include badge issuance, card revocation, and mover events in the same joiner-mover-leaver process used for digital access so the access state changes together across systems.
- Engineer roles across buildings and applications Define RBAC so that campus roles drive both physical zones and IT entitlements, with exceptions limited to sensitive areas that truly need bespoke approval.
- Monitor synchronisation as a control, not an IT task Track API gateway failures, stale interface jobs, and rejected entitlement requests as governance incidents because they can create access drift between systems.
What's in the full article
Saviynt's full case study covers the operational detail this post intentionally leaves for the source:
- The data model used to connect card credentials, photographs, group memberships, and access requests across systems
- The implementation sequence for integrating Genetec with the IGA platform and the internal API gateway
- The approval-routing logic that maps entitlement requests to the right supervisor using metadata
- The team structure and partner support model that made the rollout possible
Digital and physical access unification in higher ed: what changed?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:44 pm
Physical access is now an identity lifecycle problem, not a facilities-only problem. Once badges, buildings, meal plans, and digital entitlements sit in one control flow, the access decision becomes inseparable from joiner, mover, and leaver governance. That changes ownership, review cadence, and audit evidence requirements for IAM and physical security teams alike. The implication is that campuses and enterprises need one lifecycle model for all identity-bound access, not parallel systems with different truth sources.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, which shows how quickly governance confidence drops outside human IAM.
A question worth separating out:
Q: Who should own mixed physical and digital access governance?
A: Ownership should sit with identity governance, physical security, and business process owners together, because no single team sees the full lifecycle. If the systems share a control plane, accountability must also be shared across provisioning, review, and revocation decisions.
👉 Read our full editorial: University of Ottawa unifies physical and digital access with IGA
