How to join your access control system with video: why camera only tailgating alerts fail, how badge to body matching works, and what to ask every vendor.
Access control knows who presented a credential. Video knows what actually happened. The value is in joining them.
Vendors use the word "integration" for four very different levels. Ask which one they mean.
Camera only tailgating alerts do not work. They cannot tell two colleagues who both badged in from one person with a follower.
Badge to body matching is the method that works: alert when more people crossed than credentials were presented.
Fix the clocks first. Every rule depends on both systems agreeing on the time.
Search for access control and the first page is full of companies selling the door side: readers, panels, locks, credentials and installation. HID, Avigilon, Axis, Verkada, Johnson Controls, Gallagher, Kisi, Nedap. Good companies, accurate material.
What almost none of them cover is the join. Access control produces events about credentials. Video produces a continuous record of what happened. How the two become one clear signal sits between both sides' marketing, so neither explains it.
This guide is about that join, written from the video side.
An access control system decides who may pass through a door, gate or turnstile, and records the decision.
Physically it is credentials (a card, a phone or a fingerprint), readers at the door, a controller that makes the call, a lock, and software that manages who may go where. For our purposes the interesting part is the stream of events it produces: access granted, access denied, door forced, door held open too long, unknown credential.
The theory comes up often, so briefly. Discretionary access control lets the owner of a resource decide who uses it. Mandatory access control enforces a central policy users cannot override. Role based access control assigns permissions to roles, which is what nearly every commercial building uses. Attribute based access control decides from a mix of factors such as identity, time, place and device. In physical security, role based control dominates, usually with time of day and door group limits on top.
The three parts people are asked to name are the credential, the reader and controller that decide, and the software that holds the policy and the audit trail. What that list leaves out is the point of this guide: none of those parts can tell you what physically happened.
This is the whole case for integration. An access control system records that a valid credential was shown and the door released. It does not know several things that matter.
How many people went through. One badge gives one event, however many people follow.
Who actually held the credential. A badge is a token, not a person. Borrowed, shared, cloned and stolen badges all produce a perfectly clean "access granted".
What happened on the other side. The event ends at the door, and often the system cannot even be sure the door closed.
What a denial meant. A new joiner whose access has not arrived yet and someone testing doors along a corridor produce exactly the same event.
Video sees all of this and knows nothing about identity. That is why the two belong together, and it is a far stronger reason than the usual "one screen for everything", which is a convenience rather than a security gain.
Vendors call all four of these "integration". They are very different.
Side by side. Two systems, two screens, one room. An operator matches events by eye, in real time, and misses most of them. This is not integration, though it is often sold as one.
Camera lookup. Click an access event and see the nearest camera. Useful, cheap to build and the level most sites reach. It speeds up investigations but detects nothing new.
Event correlation. Access events and video events feed the same rules, so you can write "door forced on this door and a person seen on its camera within 30 seconds". This is where integration starts catching things neither system catches alone.
Reconciliation. The two systems check each other all the time and alert when they disagree. The classic case is badge to body counting for tailgating. Few platforms reach this level, and it is where the real value lies.
When a vendor says they "integrate with your access control", ask which of the four they mean. The answer is usually the second.
The standard advice here is wrong, and it is repeated everywhere.
It goes like this: draw a virtual line at the door, count people crossing it, and alert when more than one crosses within a few seconds. It sounds sensible and it fails on day one.
On camera, honest traffic looks exactly like tailgating. Two colleagues arriving together, each badging in properly, means two people crossing a line seconds apart. So does one person with an unauthorised follower. The camera cannot tell them apart, because the difference is not visible: it is whether a second badge was shown.
The result is an alert at every busy entrance every morning, muted within a week. That is worse than nothing. It wastes attention and convinces everyone the protection exists.
Real tailgating detection matches bodies to badges. Count the people who crossed, count the badges shown at that door in the same moment, and alert when people outnumber badges. Two people, two badges: normal. Two people, one badge: tailgate. The signal is the gap, not the headcount. It needs the two systems properly joined, with the same clock and a reliable map of which cameras cover each door. That takes more effort than a line on a screen, which is why the bad advice survives.
Visylix is an automated AI video surveillance platform built in India. It watches every camera with 22 AI analytics built in house, decides what matters with Sudarshan, its automation engine, and acts in seconds. Access control is part of that loop, not an extra.
Native connectors for the systems you already run. Visylix takes access events directly from Brivo, LenelS2 (including OnGuard OpenAccess), HID (Origo and Mercury), AMAG Symmetry and Genea or Openpath, each in its own native format, plus a generic connector for anything else. No translation service in the middle, no extra component to maintain. The connectors are built to tolerate firmware updates that rename fields, so access events keep flowing instead of silently disappearing.
One rules engine for doors and cameras. Access events enter the same Sudarshan Rules that video detections use. A rule such as "person detected and door forced on this camera within the window" fires only when both really happen together; a rule with a single access condition, such as "door forced", fires at once. Because there is one engine, door rules get everything camera rules have: AND/OR conditions, ordered time sequences, branching actions, a dry run on real history before going live, version history with restore, snooze, hourly caps, maintenance windows and a rule health board.
True tailgating detection. Visylix tailgating detection can be checked against badge swipes. It holds recent "access granted" events for each door and compares them with the people who actually crossed, alerting only when people outnumber badges. Old badge events are discarded quickly, so a stale swipe can never mask a real tailgate.
Alerts an operator can act on. Matched events arrive on the alert rail with a severity ring and an evidence frame, so the door event and the picture appear together. Each alert carries a dispatch score, and the effectiveness board shows which rules earn their keep, with one click to retune the ones that do not.
Investigation in plain language. Ask Radha, the Visylix AI copilot, "who went through the loading bay door after eight last night?" and it searches access events and video together, on premise, in seconds.
Actions that reach every system. Sudarshan notifies the right team, raises alarm incidents in the operator console, talks down intruders through the camera speaker, escalates when a critical alert is not acknowledged, and sends signed webhooks, MQTT, SIEM and PSIM events. Your access control system keeps the decision to open or lock a door, which is where that decision belongs. Where a camera relay is wired to a door strike or siren, an authorised operator can switch it, with every action audit logged.
Map doors to cameras first. Every controlled door needs to know which cameras cover it, on both sides where it matters. It is simple data entry, and everything above camera lookup depends on it.
Then fix the clocks. If the access controller and the video platform disagree by fifteen seconds, every rule is wrong, and the failures look like AI problems. Put both on the same time source. Nothing causes more integration failures, and nothing is cheaper to prevent.
Start with camera lookup. It pays off immediately in investigations and proves your door map in daily use before anything depends on it.
Then write rules for the events that matter. A short list beats a long one. Door forced with nobody seen: likely a mechanical fault. Door forced with a person seen: likely not. Repeated denials at one door within minutes. Access granted at an unusual hour for that door group. And one credential used at two doors too far apart for the time between them, the classic cloned badge signal.
Add badge to body matching last, once the door map and clocks are proven, because it depends on both.
Clock drift, as above, is the biggest single cause.
Door maps go stale. Cameras move, doors are renamed, a refit renumbers a wing, and nothing warns you. Recheck the map on a schedule.
Event delivery is assumed reliable. Access systems push events over the network, networks drop, and many vendors do not retry hard. If events stop arriving, nobody notices, because no alerts looks exactly like no incidents. Watch for the absence of expected events, not just for errors.
Complex doors confuse simple rules. Turnstiles, anti passback setups and interlocked doors produce event patterns a naive rule misreads. Understand what your access system sends before writing rules against it.
And privacy scope creeps. An access log joined to footage is a record of individual movement through a building. Settle the governance before you build, not after.
Access events carry identity; video carries images. Joined, they form a record of each person's movements, which most regulators treat as more sensitive than either source.
Under India's Digital Personal Data Protection Act and similar laws elsewhere, that means a clear lawful basis for the joined record, a retention period that may be shorter than either system's, restricted access to searches across both, and an audit trail of those searches. Consent to badge access does not automatically cover video linked movement tracking.
Two practical positions help. Keep every cross system search auditable, so you can always answer who looked up whose movements, and why. And apply the integration where it is clearly justified, usually the perimeter, restricted areas and cash or asset handling, rather than every internal door.
Running everything on your own hardware removes the cross border transfer question entirely, often the hardest part when identity and imagery are joined. Visylix runs fully on your own infrastructure, including air gapped sites, with a tamper evident audit trail and 46 permissions across 4 roles to control exactly who can see what.
Unified access control and video earns its place on perimeter and restricted doors where badge misuse has real consequences; in investigations, where camera lookup turns hours of review into a click; for genuine tailgating detection through badge to body matching; for spotting cloned or shared badges, which neither system sees alone; and for telling a faulty door from an intrusion, which changes who gets sent.
It disappoints where the door to camera map was never finished or has gone stale; where clocks are out of step; wherever camera only tailgating alerts are used; where "integration" stops at camera lookup but is sold as more; and wherever the privacy scope of the joined record was never assessed.
An access control system decides who may pass through a door, gate or turnstile and records every decision. It is made of credentials such as cards, phones or biometrics, readers at the door, a controller that makes the decision, a lock, and software that holds the policy and the audit trail. Its output is a stream of events: access granted, access denied, door forced, door held open.
Four models are usually named. Discretionary access control lets the owner of a resource decide who uses it. Mandatory access control enforces a central policy nobody can override. Role based access control gives permissions to roles rather than people, and is what most commercial buildings use. Attribute based access control decides from a mix of factors such as identity, time, place and device.
Because access control records that a valid credential was presented, not what physically happened. It cannot tell how many people walked through, whether the badge holder was the person using it, or what happened beyond the door. Video sees all of that but knows nothing about identity. Joined together, they catch what neither can alone, such as a cloned badge or a genuine tailgate.
Reliably, by matching bodies to badges. Count the people who physically crossed the threshold, count the credentials presented at that door in the same moment, and alert when people outnumber badges. Camera only systems that count people crossing a line cannot tell two colleagues who both badged in from one person with an unauthorised follower, so they alarm all morning and get switched off.
Visylix accepts access control events natively from Brivo, LenelS2 (including OnGuard OpenAccess), HID (Origo and Mercury), AMAG Symmetry and Genea or Openpath, plus a generic connector for any system that can send a webhook. A platform outside that list connects by mapping its events once.
Your access control system keeps the decision to lock or open a door, which is exactly where it belongs. Visylix alerts the right people, raises alarm incidents in the operator console, talks down intruders through the camera speaker, escalates when a critical alert is not acknowledged, and sends events to your access control, SIEM and PSIM. Where a camera relay is wired to a door strike or siren, an authorised operator can switch it, with every action recorded in the audit trail.
Visylix treats access events as security events: tailgating, forced doors, repeated denials and badge misuse. It is a security platform rather than a time and attendance system, so payroll attendance stays with your HR tools.
A PSIM (physical security information management platform) sits above many security systems and pulls them together, usually as a separate product with its own cost and integration effort. Joining access control and video inside the video platform delivers the most valuable part of that, matching door events to what the cameras saw, without another layer. A PSIM makes sense when you are unifying many more system types than video and access.
Clocks that disagree. Matching is done within a time window, so if the access controller and the video platform differ by even a few seconds, every rule becomes unreliable and it looks like an AI problem. Next come door to camera mappings that have gone out of date, and webhook deliveries that quietly stopped, which is invisible because no alerts looks exactly like no incidents.