Access control replaces a key you cannot revoke with a credential you can. Underneath the marketing it is four things working together, and understanding which does what makes quotes much easier to compare.
The credential
A fob, a card, a code or a phone. This is what the user presents.
Fobs and cards are cheap to issue and instant to revoke, which covers the main failure of physical keys. They are shareable, so strictly they tell you which credential opened a door rather than definitively which person. Keypad codes avoid issuing hardware, which suits doors used by rotating contractors, but codes get shared and almost never get changed. Mobile credentials are harder to pass around, because handing over a phone is a bigger ask than handing over a fob, and they suit places where the audit trail genuinely has to mean something.
Most buildings end up mixed, and that is a design decision rather than an indecision.
The reader
Mounted beside the door. It reads the credential and passes it on. Importantly, the reader does not decide anything, which is why a reader on the insecure side of a door is not itself a security hole.
The access controller
The part that actually decides. It holds the rules: which credentials work on which doors, at which times, and it writes the log. Good systems keep enforcing those rules when the network or the internet drops, because the controller already holds them locally. Systems that stop working when the connection does have put the decision in the wrong place.
The door hardware
An electric strike or a magnetic lock, plus the request-to-exit device and the door position sensor that tell the system what physically happened. The door, frame and closer decide what is possible on any given opening, which is why this is assessed on site rather than from a list.
The door position sensor is the component people skip and later miss. Without it the system knows a credential was presented but not whether the door actually opened, or whether it was then propped for an hour.
Fail-safe and fail-secure
What each door does when power is lost is a decision made per opening, and life safety governs it. Egress doors must allow people out regardless. This is the part of an access control installation most likely to fail inspection when it has been done by someone unlicensed, and it is not a place to improvise.
What the access control log is actually for
The log is the product. Revoking credentials is useful, but the reason to install access control on a commercial building is usually to be able to answer a specific question later: who opened the stock room at 6am, whether the contractor left when they said, how long the back door was open.
Why access control belongs with the cameras
A door event on its own tells you a credential was used. The same event alongside footage of that door at that second tells you who used it. Buying both from one contractor is what makes the two timelines line up, and it is the main practical argument against treating them as separate projects.
Doors and cameras answer different halves of the same question, which is why Elite Security scopes them together. There is more like this in the blog, and access control is where to start on the practical side.