From Turnstiles to Trust: Access Control’s Identity-First Reinvention

As buildings move beyond badges and PINs to on-device matching, this piece anchored in Innovatrics’ upcoming headquarters sets out the zero-touch, privacy-by-design model, NIST-evaluated performance, and the integration playbook for an identity layer that runs the building.

At the turnstile, nothing seemingly happens—and that’s the point. The camera verifies you, the gate unlocks, and the elevator is already on its way. What looks like an open corridor is actually an identity layer stitched together by biometrics, APIs, and privacy-by-design.

Benchmarks from NIST moved this from pitch to practice: Face Recognition Technology Evaluation (FRTE) measures how reliably a system says Yes to the right person and No to the wrong one, while Face Analysis Technology Evaluation (FATE) tests whether software can spot spoofs in real time. In other words, accuracy is tuned to strict operating points and checks you’re a live person, stopping photos, videos, or masks.

At Agora Budapest, facial-recognition turnstiles are integrated with elevator dispatch to move authenticated users directly to the right floor—a template Innovatrics is scaling in its own Most Biometric Building project.

The short version:

→ Access is an experience layer.
Identity-centric systems personalize movement, service, and comfort across a site, not just entry.

→ Zero-touch, privacy-by-design.
On-device biometrics and strict data minimization can deliver both convenience and compliance.

→ A platform, not a product.
Real value appears when access data drives elevators, lockers, meeting rooms, parking, and even energy usage.

→ MBB is the proving ground.
Innovatrics’ Most Biometric Building (MBB) pressure‑tests these journeys while building a partner ecosystem around them.

Why identity is the new foundation of building operations

Across commercial real estate, access control is being rebuilt as identity infrastructure. As Michal Vilagi, who leads access control solutions at Innovatrics, puts it: “The building should know who you are before you reach the door.”

“In the past, fingerprint scanning was the leading technology,” he explains, “But the pandemic and stricter hygiene standards accelerated the shift toward touchless solutions such as facial recognition and palm scanning.”

Innovatrics’ new headquarters in Bratislava is a live testbed for that idea. The company is fitting its campus to showcase the company’s NIST-benchmarked biometric algorithms, with a move-in window publicly discussed for 2026. That timeline matters less than the blueprint: biometric access as the identity backbone for every service a user touches.

The end of tokens

Badges and PINs are shareable, losable, and operationally brittle. A recent U.S. federal inspector‑general review documented risk from mismanaged physical access cards. It’s an evergreen reminder that non‑shareable credentials raise the floor on security. Phones help, but they are still tokens always carried around. Biometrics, on the other hand, bind access to a person, not an object.

“At MBB, once a tenant has given consent to use biometrics, they gain access to everything without needing to touch a card, phone, or keypad,” says Vilagi. “It’s access control made invisible, but always reliable.”

The same identity that admits you at the MBB gate unlocks your locker, grants after-hours lab access, and opens a meeting space. Permissions ladder up from general zones to restricted ones, and they can change in real time as roles or events shift. The result is an invisible layer of access—seamless for users but backed by multi-modal authentication (face plus palm in sensitive labs) and anti-spoofing checks at every door.

“At MBB, once a tenant has given consent to use biometrics, they gain access to everything without needing to touch a card, phone, or keypad. It’s access control made invisible, but always reliable.”
– Michal Vilagi, Innovatrics

“Our system uses cameras and real-time video streams to identify individuals before they even reach the entry,” Vilagi adds. “It can even assess intent—whether someone genuinely wants to pass through a door or is attempting to spoof someone else’s identity. This ensures tenants and visitors enjoy a completely seamless experience, while security standards remain uncompromised.”

Zero-touch only counts if it’s Privacy-by-design

For readers new to the term, zero‑touch means you move through a building without performing little rituals at every threshold—no badge wave, no PIN entry, no touching knobs and handles. The system recognizes you as you approach, opens what you need, and then gets out of the way. Convenience is the surface; trust is the substrate.

“From entering the parking garage or passing through turnstiles, to calling an elevator, retrieving a food delivery, or opening a personal locker, facial and palm recognition handle it all.”
– Michal Vilagi, Innovatrics

Under the hood, zero‑touch starts with consented enrollment at the MBB. A user opts in via a secure link and captures a short sequence used to create a biometric template. That template is not a photo; it’s a compact mathematical representation designed for matching. On arrival, a threshold camera answers a narrow question: is this the authorized person, right now? It runs liveness checks to block spoofs and performs a 1:N identification. Crucially, this computation happens entirely on‑device, so raw images don’t need to transit.When the answer is yes, the system emits a signed event and orchestrates downstream actions like destination‑dispatch elevators or lockers—not face image.

What it emits is a template, not pixels, so it can not be tuned back into a photo. It is kept in a protected storage, separate from access rights, and carry only the information needed to answer that yes/no question.

Privacy‑by‑design isn’t legal window dressing; it’s an engineering contract in the European Union aligned with GDPR’s Article 25. Collect the minimum. Process as close to the camera as possible. Keep identity data and permissions in different systems. Default to short retention with clear, audited exceptions. Every administrative action leaves a sealed, reviewable log. Users can revoke consent and have their templates removed; visitors expire automatically.

Just as important is what zero‑touch isn’t: it’s not a license for people analytics. Access events are discrete security decisions, not a live map of everyone’s movements. If occupancy insights feed HVAC or safety systems, they do so in aggregated, purpose‑limited form governed by the same retention and transparency rules.

“We design for privacy first,” Vilagi notes. “We store only what’s needed to operate.”

Field notes from Bratislava

Zero-touch access for employees and pre-vetted visitors from curb to desk, including parking, lobby, speed gates, elevators, and doors, driven by remote visitor onboarding based upon Innovatrics access control system
Layered permissions for open plans and secure labs, with multimodal checks (face + palm) in high-security zones
Operational telemetry (occupancy, zone entries) feeding building systems for energy and services tuning in real time

Turning access data into building intelligence

Zero‑touch produces a stream of signed events, and those are gold for everything beyond the turnstile. When identity signals flow into the building management system (BMS), controls stop guessing and start responding to who’s actually there.

HVAC setpoints track verified occupancy instead of static schedules; lighting trims in empty zones and ramps when a room fills; fresh-air rates nudge up when a meeting overruns. In studies, occupancy-based control delivers double-digit energy savings—simulations in the 13–23% range, with field work now showing real-world wins because the system stops conditioning space no one is using.

Security sharpens, too. The same pipeline that verifies identity also evaluates liveness to catch spoofs in real time. As Vilagi puts it, the system is built to “recognize and block suspect attempts as they happen,” which means misuse is throttled before it becomes an incident. Even in open spaces like shared offices, the system allows security teams to define flexible access zones for specific groups of people. If someone enters an area where they don’t belong, the system immediately alerts staff. It raises the level of security without unnecessary physical barriers.

Productivity rides the same rails. Because journeys are modeled end‑to‑end, a verified arrival can auto-check in a room, release it on a no‑show, or trigger a locker pickup. Team‑level dashboards expose comfort levers within safe ranges, while the BMS enforces the guardrails.

“We want users to collaborate with the building,” Vilagi told colleagues during a recent progress briefing.

Beyond speed

One of the most tangible advantages is speed. Passing through an access point without fumbling for a card or searching for a phone makes a big difference, especially when tenants cross multiple checkpoints several times a day. The time savings quickly add up. “When you factor in how often people forget their access cards or leave their phones behind, the efficiency gains become even more significant,” says Vilagi.

But convenience isn’t the only outcome. Once the basics of speed and reliability are in place, tenants often experiment with ways to adapt biometric access to their own preferences. In one project, a client installed a camera directly above a turnstile. The system only recognized the user once they looked up at the ceiling. It was their way of adding an extra layer of consent by forcing people to physically tilt their heads upward as a conscious confirmation of biometric use. “It was unconventional, but it worked,” Vilagi recalls.

Michal Vilagi serves as Solution Manager for Innovatrics’ Access Control and Building Security Platform, where he drives the product strategy and solution delivery for next-generation biometric security in enterprise and government buildings.

Q&A: Michal Vilagi on Identity-First Buildings

Q: What’s the single most important principle behind the Most Biometric Building (MBB)?
Vilagi: Integration. Everything needs to be integrated, or else, you end up with isolated systems that can’t deliver a coherent user journey from parking to desk.

Q: What are the most impactful integrations you’ve seen between access control and other building systems?
Vilagi: Biometrics won’t just control access to doors at the MBB. They’ll be integrated with parking, elevator systems, visitor management, all types of lockers, and even printers. The goal is simple: no one should ever need to carry a physical token. A face or a palm is all you need.

Q: How do you keep the balance between convenience and safety?
Vilagi: We verify both identity and intent. If someone tries to spoof the system, we block the attempt in real time without slowing down genuine users.

Q: What misconceptions do people still have about biometrics-based access control?
Vilagi: Three stand out:
1. ‘It slows people down.’ In reality, traditional systems require preparation like finding a card or pulling out a phone, while biometric access happens instantly.

2. ‘It’s less secure.’ Biometrics prevent lost or shared cards. Our algorithms are benchmarked at NIST labs.

3. ‘Biometric data can be misused.’ Innovatrics’ system operates entirely on the edge, meaning no template or image data ever leaves the camera. Sensitive information remains protected at all times.

Tailored access for every tenant

In a building like the MBB, not everyone will use space the same way. Long-term tenants, coworking members, and one-time visitors all need different levels of access. Instead of relying on fixed locks, permissions are managed in software and can be reconfigured instantly. An event organizer who needs the lobby and conference hall for a weekend can be granted the right credentials remotely, no locksmith required.

“The system is fully managed through a web platform, making changes simple and intuitive,” says Vilagi. “Whether it’s onboarding a new tenant, hosting an event, or granting temporary access to a visitor, the process is seamless. Even first-time guests can enjoy the same frictionless journey as permanent tenants.”

NIST FRTE and FATE — Why they matter

The National Institute of Standards and Technology (NIST) independently evaluates face recognition (FRTE) and face analysis (FATE) algorithms—showing how they perform across demographics, lighting/pose, masks, and video so buyers see measurable results, not marketing.

FRTE is when the system blocks the right person, which can be annoying but fixable. FATE is when the wrong person gets in, which can happen on rare occasions. The point is to keep FRTE low so people move freely, and FATE near zero so trust isn’t compromised. NIST gives operators confidence that both can be achieved at the same time.

Implementation playbook for property managers & integrators

Start with journeys, not devices. Map employee, contractor, and visitor flows first. Identify every physical handoff (gate → lobby → elevator → floor → room → locker). Then assign identity assertions and permissions by step.
Choose evaluated algorithms. Shortlist vendors with public FRTE (identification) and FATE/PAD (liveness/spoofing) results. Ask for numbers at your operating point (e.g., FMR = 10⁻⁶) and test under your lighting, angles, and traffic patterns. If the results aren’t documented, treat the claim as unproven.
Orchestrate beyond the door. Tie access to elevators, meeting systems, lockers, and parking from day one. Run end-to-end tests for peak hours and failure modes.
Partner where it makes sense. At the MBB, biometric facial recognition has been integrated with Nedap AEOS locker management among others—evidence that best-of-breed pairings are viable in production.
Design for privacy. Process on the device or at the edge when possible; keep templates, not photos. Default to short retention (weeks, not years) with audited exceptions, sealed admin logs, clear notices, and easy opt-out/expiry for visitors.
Plan for packages and meters. If you expect flexible tenants or event traffic, integrate access with membership/billing so permissions (zones, hours) and charges follow the plan.

What comes next?

Palm recognition is the most likely next step into the mainstream. Not only does it feel natural, but it also sidesteps some of the hesitation around face-based systems. In high-traffic lobbies, it’s quick, while in privacy-sensitive zones it’s reassuring. As deployments accumulate, familiarity and not hype will do most of the adoption work.

“As biometrics become standard in commercial buildings, palm is resonating as an intuitive option,” says Vilagi. “It lowers the barrier for people who prefer not to use face, without sacrificing security.”

The future isn’t one modality to rule them all but multimodal by design: face for frictionless throughput, palm where user preference or policy calls for it, and even iris where security is non-negotiable. The real test is whether platforms let owners mix these choices zone by zone—with consent, short retention, and clear controls—so the identity layer stays flexible as buildings evolve.

Trust by design

Buildings that prioritize identity-driven security do more than keep people safe. They simplify movement, raise tenant confidence, trim operational waste, and unlock new business models. Innovatrics’ MBB is a compelling case study not because it’s a headquarters, but because it treats access as the platform upon which the modern building runs.

“Biometric access isn’t presented as a gadget or gimmick, but as the connective tissue between identity, space, and services.”

For Vilagi and his team, the MBB is less about building a showroom and more about proving trust by design works. Biometric access isn’t presented as a gadget or gimmick, but as the connective tissue between identity, space, and services.

For property managers and tenants, the lesson is straightforward. When a building knows who you are, it can give you comfort, freedom of movement, and confidence that safety isn’t compromised. That foundation of trust is where the real reinvention begins.

AUTHOR: Mark Quiazon
ILLUSTRATIONS: Julia Latusek