An access credential is the token a person presents at a reader to request entry: a card, fob, phone, keypad code or fingerprint. The controller compares it with a permission list, so the credential identifies the person while the decision to unlock belongs to the system.
Credentials are the part of access control people touch every day. The type a site chooses decides which readers, controllers and enrollment tools it needs, and how easily access can be withdrawn.
Credential types and carriers
A proximity card or fob holds a number that a reader picks up at close range, and a mobile credential stores the same number in a phone wallet. A PIN carries no physical token at all. Biometrics read a trait instead of a token, so the credential cannot be lent to another person.
Issuing and revoking access
Every credential needs a lifecycle: assigned to one person, given a permission group, and revoked when that person leaves. A shared card defeats the audit trail, because the log can no longer show who opened the door. Enrollment should record who approved the credential and when it expires.