Skip to content
IDMATICNET
RUENRU

Right lifecycle

Every state of a right has an accountable owner, grounds and an audit record.

  1. 1. Grounds

    An HR document, contract, work permit, visit request or booking. The grounds define the maximum validity of the right.

  2. 2. Approval

    A route with roles, review deadlines and recorded decisions. Rejections are recorded as well.

  3. 3. Right

    A record is created with subject, object, action, zone, validity and execution conditions.

  4. 4. Execution

    The control point verifies the right and takes a decision. Verification runs locally when the link is unavailable.

  5. 5. Presence and custody

    Presence in a zone and custody of a key, asset or equipment are recorded.

  6. 6. Change or revocation

    Extension, narrowing, suspension or revocation, performed by an authorised person with a stated reason.

  7. 7. Completion

    Automatic expiry and closure of the related obligations.

  8. 8. Audit

    An evidential record of every state: grounds, decisions, execution, deviations and manual actions.

Full diagram of the physical right lifecycleThe main White Paper diagram: eight states and the transitions between them.

Denial scenarios

A denial is as much a governed outcome as a permission.

  • The right does not exist or has not yet been approved.
  • The right does not cover this zone, door or action.
  • The right has expired — validity is checked locally at the control point.
  • The right has been revoked and appears in the current revocation list.
  • Execution conditions are not met: a clearance is missing, escorting is required, or the passage sequence is violated.

Manual decision

Revoking a right and a trusted device

Revocation applies both to the right and to the subject's trusted device. Revoking a device stops the right from being presented from that device without changing the right itself; revoking the right invalidates every associated means of presentation.

How quickly a revocation takes effect depends on the connectivity mode of the control point: with a link or an Edge Hub it propagates promptly, whereas a fully isolated point applies it at the next revocation-list update.

Related pages