Access control is the formal term for how a commercial building manages who can go where, and when. In a Melbourne CBD office environment — a multi-tenancy floor in a Collins Street tower, a boutique law firm occupying level 30 of a building on William Street, a co-working space running across three levels of a Bourke Street building, a retail tenancy in the GPO or on Swanston Street — access control is not a single system but a hierarchy of systems, each managing a different layer of the building.
Understanding that hierarchy — what each layer controls, who manages it, and what happens when the layers don’t align — is the starting point for making good decisions about commercial access control in a CBD office. A locksmith working in the Melbourne CBD is frequently engaged not just to repair or replace hardware but to help a business understand and design its access control architecture.
The Melbourne CBD Office Access Hierarchy
Modern Melbourne CBD office buildings operate a building-wide electronic access control system managed by the building owner or their facilities management company. This system covers all common property: the lobby entry, the lift banks, the basement car park, the end-of-trip facilities, and any shared amenity floors. Tenants receive key cards or FOBs programmed to their floor and the appropriate common areas. The building management system logs every access event against every credential.
The tenant’s own space — the floor, the suites, the internal meeting rooms and offices — is managed by a separate layer that the tenant controls. This typically comprises:
Suite entry cylinder
The physical cylinder on the office’s main entry door, operating on a key and typically under a master key arrangement for the tenancy. This is the hardware the locksmith manages.
Internal access zones
Larger tenancies — law firms, financial services businesses, government departments occupying full floors in Exhibition Street or Collins Street — often have internal access zones within the floor. The server room, the document storage area, the principal’s offices, the reception-facing areas. Each zone may have its own physical cylinder or an electronic access reader managing access.
Electronic tenant access control
Some CBD tenants operate their own electronic access system on the floor, independent of the building’s system. A technology firm with a strong security culture might run key card readers on every internal door and a visitor management system at the lobby. This is a standalone system, managed by the tenant, and its credential management is the tenant’s responsibility.
The critical point is that the building system and the tenant system are separate. When a CBD business changes a member of staff, two credential management actions are required: the building management company needs to deactivate or reprogram the departing employee’s FOB for lobby and lift access, and the tenant needs to update their internal key access (rekey if the employee held a physical key, or deactivate the electronic credential if they held a key card).
Pro Tip: When a CBD office employee leaves — particularly on short notice or in difficult circumstances — notify building management immediately to deactivate their building FOB, and call your locksmith to assess whether your internal cylinders need rekeying. The two systems are independent; deactivating one doesn’t touch the other.
Master Key Systems for CBD Office Floors
A master key system for a Melbourne CBD office tenancy is designed to reflect the organisation’s internal access hierarchy — who needs to go everywhere, who needs to go to their own area plus common spaces, and what areas require tightly restricted access.
For a professional services firm on a CBD floor, the hierarchy typically runs:
Grand master
The managing partner, the building facilities contact, or the firm’s security manager. Opens every cylinder on the floor without exception. Typically two physical copies, stored separately, and treated as a controlled access credential.
Floor master
Operates all non-restricted areas on the floor — the entry suite door, all internal offices, meeting rooms, and general use areas. Held by senior management or a trusted operations contact.
Area keys
Individual offices, specific zones. A lawyer holds a key to their own office and the meeting rooms; they don’t hold a key to the server room or the document storage vault.
Restricted cylinders
The server room, the board room, the senior executives’ suites, the document storage area. These cylinders sit outside the master key system — or at a level of the hierarchy that only the grand master operates. No area key or floor master works on them.
The restricted keyway is what makes this system manageable: all cylinders in the system use a key profile not available from any retail key cutter. Key duplication requires written authorisation from the registered system holder, processed through the locksmith who manages the system. When an employee leaves and hasn’t returned their physical key, the cylinder doesn’t need to be changed — because the key they hold can’t be duplicated. The risk is bounded.
Electronic vs Physical Access Control: What the CBD Context Suggests
The Melbourne CBD office market has seen significant growth in electronic access control adoption, particularly since the COVID period changed occupancy patterns and hot-desking reduced the fixed-desk model that physical key systems were designed around.
Electronic access control — key card, fob, or mobile credential systems — offers significant management advantages in a high-turnover CBD office environment. Credentials can be issued, modified, and revoked from a management console without any physical locksmith visit. An employee starting on Monday morning can have a credential issued before they arrive. A credential can be set to expire automatically at the end of a contractor’s engagement. An access log shows exactly when each credential was used at each door. These are meaningful advantages in a CBD environment where staff numbers can change quickly and visitor management is a daily operational task.
The trade-off is system dependency. An electronic access control system requires power, network connectivity, a functioning management console, and a credential management process that someone is actively running. A power failure, a network outage, or a lapsed maintenance contract on the management system creates access gaps that a physical key system doesn’t face. For this reason, most CBD office tenancies use a hybrid approach: electronic access control on the main entry and high-traffic internal areas, with physical cylinder locks on the restricted zones and as a backup access method.
Pro Tip: If your CBD office uses electronic access control, test the power-failure fallback every six months. Most electronic readers have a physical cylinder override that allows key access when the reader has no power — check that the override cylinder is serviceable and that the correct person holds the key.
Credential Management: The Gap Most CBD Businesses Miss
The physical and electronic hardware of a CBD office access control system is typically well-maintained. The cylinder works, the key card reader responds, the electronic system logs events. The gap that creates real security exposure is credential management — the process of issuing, tracking, and revoking the keys and credentials that operate the system.
In a busy CBD office, credential management is often informal. Keys are cut for new employees without being entered in a key register. A key to the document storage room has been held by four different staff members over three years, and the register hasn’t been updated to reflect the current holder. A former employee had a key that wasn’t returned at departure, and the rekey decision was deferred because the hardware change cost was considered high and the risk low.
The key register is the document that makes credential management real. Every key issued, to whom, for what cylinder, on what date, and the authorisation behind the issue. Every return recorded. Every departure that resulted in a key not being returned documented and the resulting rekey decision logged. In a CBD commercial building — operating in Victoria’s highest-crime LGA, with significant theft and break-in rates — a key register isn’t an administrative formality. It’s the operational document that determines whether a business actually controls access to its premises.
A Collins Street Law Firm: Access Control Architecture Review
I was engaged by a boutique law firm occupying level 30 of a Collins Street building. They’d grown from six people to twenty-two over three years and their access control had scaled informally — keys cut as new people joined, a master key held by the office manager, two other staff members who’d been given copies of the master “temporarily” and had never returned them.
Assessment: fifteen keys of various access levels in circulation, key register last updated two years prior, three keys unaccounted for (one departed employee, two “not sure”). Server room key: three copies issued, two verified held by current staff, one unaccounted for.
We implemented a restricted keyway master key system across the floor, replacing all cylinders. The new system had a grand master (managing partner, two copies), a floor master (office manager), and individual differs for each office plus a restricted cylinder set for the server room and document storage. New key register established, signed by every key holder. Access log protocol set up for the server room door.
Total cylinders: fourteen. Setup time: one full day. The firm’s access exposure — unaccounted keys on an unrestricted keyway — was fully closed.