Presence as a Credential

## What the door actually decides A badge-controlled door runs one decision, and it is worth stating in full because the whole answer follows from it. A card is presented; the reader recovers a number from it; the controller asks whether that number is permitted for this door at this time; if it is, the strike releases for a fixed few seconds. That is everything the system knows. It does not know who was holding the card, whether the holder was under duress, which direction anyone walked, or how many people were standing in the doorway. So the grant supports exactly one claim: **a permitted credential was presented at this reader**. It does not support the claim that the credential's registered holder was present, and it says nothing at all about a count of people. This is the same directional discipline that applies to any authentication: acceptance proves a credential was accepted, not that a human was there. Tailgating is the technique that lives in the second half of that gap. The door is released **for a duration, not for a body**. The person behind presents nothing, so there is no weaker check to pass and no partial match to notice — the second person simply does not exist in the model the door is running. ## Why the leaf calls this presence as a credential Entry is only half the value. Consider the environment an authorised physical assessment usually meets: one flat office floor, hot desks, shared printers, meeting rooms, wall ports, a kitchen. The badge line at the front is the only point on that floor where anything was ever asked to prove itself. Past it, **presence becomes the credential**. Nobody asks a person sitting at a hot desk whose desk it is. A printer serves whoever walks up to it. A meeting room with a screen and a wall port is available to anyone already inside. People hold internal doors open for a stranger who is clearly already through the front, because being through the front is the proof. The classic form on a scoped exercise is the morning crowd: at 08:40 a queue forms, everyone has a coffee in one hand, the door is open more than it is shut, and holding it for the person behind you is simple politeness. The assessor's cost is a plausible reason to be in the queue. The social contract does the rest — refusing to hold a door for someone requires a person to be rude to a stranger on the strength of a suspicion, and most people will not. ## Tailgating versus piggybacking Usage varies between organisations, but the useful split is consent. **Tailgating** is slipping through behind someone who does not notice or does not react. **Piggybacking** is when the person actively holds the door because a pretext worked — hands full of boxes, a lanyard turned the wrong way, a phone call in progress. The physical outcome is identical; the difference tells you which part failed. Piggybacking says the pretext beat a person who was paying attention, which is a different problem from a door nobody was watching. ## Why the obvious mitigations do not bite *Anti-passback* rules say a credential that entered must exit before it can enter again. That defeats card sharing and casual re-entry, but the tailgater never presents a credential, so anti-passback has nothing to act upon. *Coloured visitor badges* and *sign-in sheets* only work if a human compares them against something and is empowered to act on a mismatch. On a busy floor neither condition usually holds. *Longer, more unique card numbers* address a completely different technique — copying a credential — and do nothing here, because no credential was involved. ## What the control classes are There are only three honest ones, and they map cleanly onto what the technique cannot substitute: 1. **A physical interlock that admits one body per presentation** — a turnstile or an interlocked pair of doors at a choke point. This is the only class that removes the technique outright, because it changes the unit of the grant from a time window to a person. It scales badly: fire doors, goods entrances and accessibility routes all have to exist, so it is chosen for one or two choke points, not for every leaf of every door. 2. **A challenge culture with named air cover.** A receptionist or an employee will only refuse a confident stranger if a named manager will back them and a wrong refusal is never punished. Without that, asking people to challenge is asking them to absorb personal risk on the organisation's behalf. 3. **Reducing what presence buys.** If being on the floor unlocks nothing further — no unattended unlocked session, no unauthenticated printer job, no live wall port — then the entry is worth much less, and this is usually the cheapest of the three. ## How to answer it in a loop Lead with the invariant: the door counts credentials, not bodies. Then say what the entry converts into — an unchallenged position on a floor where nothing else asks. Then name the control class rather than a product or a poster.