One Ledger, Two Worlds: Auditing Building Badges and API Keys Together
Photo: security audit checklist clipboard server room access control, via imgv2-2-f.scribdassets.com
Somewhere in your organization right now, two teams are preparing for two different audits, using two different spreadsheets, to answer what is fundamentally the same question: who has the ability to enter a space they shouldn't, and when did we last check?
On one side sits the facilities or workplace team, reconciling badge reader exports against an employee roster. On the other, an engineering lead is pulling IAM policies and SSH key inventories for the SOC 2 Type II evidence request. Neither team can see the other's data. Both would fail if an auditor asked them to. And both are spending weeks producing evidence that a unified system could generate in an afternoon.
The Regulatory Patchwork Demands a Unified Answer
US companies rarely face a single compliance framework. A healthcare SaaS vendor in Boston might juggle SOC 2, HIPAA's physical safeguard requirements, Massachusetts' 201 CMR 17 data protection rules, and a customer-mandated pen test, all in the same quarter. A logistics platform in Texas adds Texas DPS facility requirements and, increasingly, customer questionnaires that probe everything from badge logging to service-account rotation.
The overlap is striking. HIPAA's physical safeguards standard explicitly requires controls on facility access to systems containing PHI — the same concern SOC 2's CC6 series addresses for logical access. Auditors under both regimes want three things: a current inventory of access grants, evidence that revocation happens promptly, and a log trail showing who entered what and when.
Yet most organizations answer those questions twice, once per silo, and the answers frequently contradict each other. The badge system shows a contractor deactivated in March. The cloud IAM export shows the same contractor's service account issuing API calls in June. Each team was technically compliant with its own audit scope. Together, they left a hole open for a quarter.
Modeling Access as a Single Graph
The fix is architectural, not procedural. Instead of treating a keycard and an OAuth token as unrelated objects, model both as edges in one access graph: a principal (person, service, or device) holds a credential, which grants entry to a resource (a room, a server, a data set), possibly conditioned on context (time, location, role).
Once physical and digital grants live in the same model, three audit-critical queries become trivial:
- Full inventory. List every credential a principal holds across both worlds. Auditors love this; siloed teams can't produce it.
- Orphan detection. Find credentials whose owner has left, changed roles, or whose associated resource no longer exists. This is where dormant keys and ghost badges surface.
- Cross-domain correlation. Flag when a person with badge access to a data center also holds standing production credentials — a combination no single team reviews today but that auditors increasingly probe.
A mapping layer earns its keep here. When every grant carries a location dimension — a building, a rack, a region — the graph becomes navigable. A compliance lead can look at a floor plan and ask, "Who can reach this room?" and get an answer that includes both the badge in someone's wallet and the VPN route to the camera system inside it.
What Auditors Actually Ask For
Having sat through evidence-collection cycles, the pattern is predictable. Auditors want to see that access decisions are deliberate, revocation is timely, and logging is complete. The failure mode is never a malicious insider; it's a credential nobody remembered existed. A unified graph, refreshed continuously, turns "trust us" into "here's the export."
A Checklist for Your Compliance Lead
Hand this to whoever owns your next audit cycle:
- Unified principal inventory. One list of every human and service identity, joined across HR, IAM, and the access-control system.
- Credential-to-resource map. Every badge, key, token, and certificate tied to the specific rooms, systems, and data sets it unlocks.
- Joiner-mover-leaver evidence. Timestamped records showing access granted on start, adjusted on role change, and revoked within a defined SLA (48 hours is a common benchmark) on exit.
- Cross-domain conflict report. Flags for any principal holding both physical access to sensitive facilities and standing digital access to the systems housed there.
- Dormant credential sweep. Any credential unused for 90+ days, with a documented disposition.
- Immutable access logs. Entry and authentication events retained per your framework's requirements, with tamper evidence.
- Quarterly attestation. A named owner signing off that the graph above reflects reality.
None of this requires new headcount. It requires that the badge system and the identity provider stop pretending the other doesn't exist. Draw the map once, and every subsequent audit becomes a query instead of a fire drill.
