Zonal Access Control Logic and Execution Order

Problem

You need to understand how conditions are evaluated in a zonal access control configuration, including the execution order, how "OR" logic works and how failed checks affect what is checked next, so that access is granted or denied correctly.

Resolution

1. Understand the condition evaluation order

   • Conditions are checked one by one, from top to bottom, in the order set by the system administrator.
   • The order can also depend on when the conditions (rules) were created.
   • A typical initial sequence is:
     1. Entry Point Check: verifies that the member is trying to access a valid zone.
     2. Alert Priority Check: checks for active alerts that could block access.
     3. Status Check: confirms that the member's status allows access (for example, active and not suspended).
     4. Site Check: confirms that the member is linked to the correct site.

2. Understand how failed conditions are handled (OR logic)

   • If a condition fails, the system moves on to the next set of conditions in the same "OR" block, again from top to bottom.
   • This allows alternative ways for access to be granted if an earlier check fails.

3. Follow an example: high-priority alert

   • The system checks the Entry Point. If it is valid, it checks Alert Priority.
   • If a high-priority alert makes that check fail, the system moves to the next condition in the OR block, such as the member's Package.
   • If the member has the correct package, the remaining conditions (for example Status and Site) are checked. If the package is not valid, access is blocked.

4. Remember that previous conditions are not rechecked

   • Once evaluation moves to a new block because a condition failed, earlier conditions are not revisited unless a new, separate logic block is added.
   • If all checks in the current block fail, access is denied.

5. Add further condition blocks (if applicable)

   • Add conditions to control access more tightly. Each new block follows the same top-to-bottom order.
   • Example block: Package Check > Entry Point Check > High Priority Alert Check > Package OK Status Check.

6. Decide the order as the administrator

   • The system administrator configures which conditions are used and in what order, based on your organisation's priorities and access policies.

7. Deactivate old rules rather than deleting them

   • When you create new rules, deactivate the old ones instead of deleting them.
   • Deleting a rule does not remove it from the front desk system, so an old rule may still allow access even when the newer rules fail.

8. Check the access zone settings

   • The Club Centric zonal set-up uses these values:
     • Grace Period: how long a member can re-enter the zone without a new entry. Set to 0 minutes, so every entry is logged.
     • Passback Period: how long after the grace period re-entry is blocked. Set to 1 minute.
     • Monitoring Mode: set to Semi Monitored, so staff make manual checks only if issues or alerts arise.
     • Active Status: make sure the access zone is enabled, or its configuration does not apply.

Notes

• The order of conditions affects both security and convenience; customise it to enforce your access rules accurately.
• Access is most often denied because the member's package is not included in the package-based rule. Check that the member's package is permitted before they try to enter, to avoid unnecessary rejections.
• Entry restrictions based on date of birth (for example, birthdays) cannot be set up in zonal configuration.
• The same zonal logic applies in the Club Centric system.

• Related: Configuring Access Control Entry Point Profiles in the GMC.

This page as markdown · All pages · llms.txt