Skip to main content

Define an Access Rule

Goal: link a physical credential — a PIN or RFID card — or an exit/call event to an action, so presenting a credential at a door unlocks it (or runs a macro, or just logs the event).

Access Control rules connect access hardware (keypads, card readers, intercoms, REX inputs) to GEM actions, with time windows and per-user authorization.

Before you start​

  • You're logged in as an administrator.
  • The access device (keypad, reader, intercom, lock) is commissioned (see Commission a Device).
  • The users who should be authorized exist with credentials set (see Create a User).

Steps​

  1. Open Access Control and click Add.

    Open Access Control

  2. Name and Description — what the rule is for (e.g. front_door_staff).

  3. Access Device — the device that receives the credential.

  4. Type — the credential or event:

    • PIN / RFID — a presented credential.
    • REX (Request to Exit) — a credential-free exit button or sensor.
    • Call — an intercom call button / doorbell press.

  5. Who is authorized — choose any of:

    • specific users,
    • an access group (a reusable set of users) — see the tip below, or
    • anyone holding a given role.

  6. Action — what happens on success: unlock the door, run a macro, trigger a scene, or Log Only (record the event without acting).

  7. When it applies — restrict by Days and Hours, with exception dates and shared holiday calendars for closures.

  8. Guards (optional):

    • Cooldown — suppress repeated triggers within a time window.
    • Duress PIN — a per-user second PIN that grants access and fires a silent panic action.

  9. Click Save Access Rule.

Use access groups for membership

If many rules share the same set of people, put them in an Access Group and reference the group instead of listing users on each rule — then membership changes in one place.

Open Access Groups

Lockdown and egress

Lockdown mode is a system-wide kill-switch that restricts access to opt-in rules. REX always works so fire egress is never blocked — keep exit paths on REX rules.

Verify it​

Present the credential (or trigger REX/Call) at the device and confirm the action runs and the event appears in the access log. Check it's correctly denied outside the configured days/hours.

  • Create a User — set the PINs/cards the rule authorizes.
  • Access Control, Access Groups, and Holiday Calendars in the Admin Reference.