Access rights that adapt to certifications, contracts, and roles. Based on rules you define yourself in the management software, without manual work and without AI.
Concept
What dynamic access is
With dynamic access, you define rules: who meets which conditions is allowed to open which cylinders. A valid certification, current employment or a contract, a job title, a location. The management software checks these rules with every change in the data of a person or lock and assigns or revokes rights.
An administrator maintains the data; the rights derive from this. During an audit, you show the rule.
Rules, not AIModule Dynamic Tags (CAW-M10)Works with your key planVisible in the audit trail
Static
Someone is granted rights and holds them until an administrator removes them. Usually too late: the certificate has already expired, the contract has ended, and the colleague has already been transferred.
Dynamic
Rights follow rules. If someone meets the conditions, the right applies. If they no longer meet them, it lapses. No administrator needs to be involved in this.
Try it
Change one piece of data and see what the key might
A technician, three doors. The rules are fixed; you only change the details.
High-voltage room NorthRule: certified and employed and located in the NorthOpen
High-Voltage Room SouthRule: certified and employed and South locationOpen
WorkplaceRule: in serviceOpen
In practice: the modified entitlement is available on the key at the next update at an update point or via telephone. A key that is not updated expires automatically.
Three situations
When dynamic access makes the difference
The day a certificate expires
Qualification
A technician may only enter a high-voltage room with a valid authorization. On the day that authorization expires, the right lapses. It is automatically restored upon renewal.
The right expires on the day of expiration.
The last day of a contract
Contractors and subcontractors
External employees are assigned rights with an end date. On that day, all rights expire without action by an administrator. An extended contract requires adjusting a single date.
All rights expire on the end date
The day of a transfer
Function or location changes
If someone changes location, team, or position, their rights change with them. The old ones expire, and the new ones apply. This also applies to an employment contract that ends.
Previous rights expire upon the transfer.
This is how it works
From data to rights, in four steps
1
Fields
You define fields on people and locks: a date, yes/no, a number, or a choice from a custom list. For example, “certificate valid until”, “contract until”, or “location”.
2
Lines
A dynamic tag is a rule with conditions, to be combined with and/or. “Certified” means: the certificate date is after today AND the introduction has been completed.
3
Tags
The software recalculates who and what falls under a tag with every change. For each tag, you can see who currently meets the criteria.
4
Rights
In the access matrix, you link schedules to tags instead of to people. If the tag changes, the entitlement changes.
On the key
A modified right appears on the key at the next update, at an update point, or via telephone. A key that is not updated expires automatically. This ensures that a revoked right does not remain active.
Delineation
What it is and isn't
✓Well
Rules that you draw up yourself and can explain to an auditor.
Works with the Active Directory / Entra ID integration: leaving the company in AD means access is lost.
A way to link access to qualifications, as required in standards and guidelines. See Compliance.
✕Not
No AI that decides on its own. What is set happens.
No work permit. The fact that someone is allowed in does not indicate what work they may do. Dynamic access does, however, ensure that access and qualifications match.
No replacement of key issuance and return. The audit trail is key-dependent; the issuance process remains the basis.
Frequently Asked Questions
About dynamic access
Is dynamic access the same as conditional access?
No. Conditional access (Microsoft Enterprise ID) concerns logging into accounts and applications. Dynamic access concerns doors, cylinders, and keys. The idea is the same, however: a right applies as long as the conditions are met.
What information do I need?
Only the fields for which you want to create rules, such as the expiration date of a certificate or contract, or the location. You enter these per person or import them from a CSV file. The individuals themselves can come from Active Directory / Entra ID.
When does the key detect a change?
At the next update at an update point or via telephone. Therefore, a key is assigned a limited validity: if it is not updated, it will no longer work. The shorter that validity, the sooner a revoked right also expires in the field.
Does it have AI?
No. Dynamic access works on rules that you define yourself: conditions on fields, combined with and/or. The outcome is predictable and can be explained afterwards.
What do I need for it?
CyberAudit-Web Enterprise with the Dynamic Tags module (CAW-M10). The module can be added to an existing license. Sellox configures the fields and rules together with you.
