Anti-passback and tailgating detection are two physical security controls that get requested together often enough that building owners and security consultants sometimes assume they address the same vulnerability. They don’t. Anti-passback is a software control enforced by the access control system that prevents credential abuse. Tailgating detection is a physical or video-analytic control that prevents unauthorized physical access by following an authorized person through a door. Deploying one does not provide the protection the other offers, and the hardware requirements for each are sufficiently different that specifying both without planning for both is a common source of change orders at installation.
What anti-passback actually prevents
Anti-passback prevents a credential from being used to grant entry to an area that the credential holder has already entered and not yet exited. The most common use case is a parking facility: a credential holder scans to enter, and the system records the entry event. If the same credential is presented to the entry reader again without an intervening exit event, the system denies access or logs a violation. This prevents one person from entering, handing their badge back through a fence or window, and allowing a second person to enter with the same credential.
Anti-passback requires two readers per door — one for entry and one for exit — so the system can track the credential’s state (in or out) in each zone. A door with a single entry reader and a push-to-exit button cannot enforce anti-passback because exit events are not recorded as access events tied to a specific credential.
There are two enforcement modes:
- Hard anti-passback: The system denies access when an anti-passback violation is detected. Stronger enforcement, but can inconvenience legitimate users when the system loses track of their state (a held-open door with no exit scan, a system restart that loses location state).
- Soft anti-passback: The system logs the violation but grants access anyway. Useful for environments where operational continuity is more important than strict enforcement, or where the system is being tuned before switching to hard enforcement.
What tailgating detection actually prevents
Tailgating detection prevents unauthorized access by physical following — one person using another person’s authorized door opening to pass through without presenting credentials. The threat model is different from anti-passback: the attacker doesn’t have a valid credential for this door and relies on social proximity or speed to follow an authorized person through before the door closes.
Tailgating detection requires physical infrastructure that anti-passback does not:
- Optical turnstiles: Physical barrier lanes that allow one person per credential event. The most reliable tailgating prevention for high-traffic entry points such as corporate lobby entrances. Hardware cost ranges from $8,000–$40,000 per lane depending on cabinet design and barrier type.
- Mantrap / airlock vestibule: Two-door interlocked entry where the first door must close and lock before the second opens, with occupancy detection limiting passage to one person per credential event. Effective but creates a bottleneck for high-traffic applications.
- Video analytics with AI body detection: Camera-based detection of multiple bodies in a door zone, triggering an alert when more than one person passes through on a single credential event. Lower hardware cost than turnstiles; detection accuracy varies by lighting, camera angle, and body orientation.
| Control type | What it prevents | Hardware required | Typical application |
|---|---|---|---|
| Anti-passback (hard) | Credential sharing (same badge, double entry) | Entry + exit reader at each controlled door | Parking, secure zones, time-and-attendance areas |
| Anti-passback (soft) | Credential sharing (log only) | Entry + exit reader at each controlled door | Low-security areas, anti-passback tuning phase |
| Optical turnstile | Physical tailgating (one body per credential) | Dedicated turnstile lanes; typically 3+ for normal flow | Corporate lobby, data center entry, transit-style access |
| Mantrap / airlock | Physical tailgating (one occupant at a time) | Two interlocked doors, occupancy sensor, controller | Server rooms, vault entries, high-security vestibules |
| Video analytics (AI body count) | Physical tailgating (detection, not prevention) | Camera with AI analytics capability, ACS integration | Standard door frame areas, budget-constrained retrofits |
The hardware gap that creates specification errors
The most common specification error is requiring both anti-passback and tailgating detection at a door without specifying the hardware for each. Anti-passback adds one exit reader per door to the bill of materials — a $300–$600 incremental cost per door. Tailgating detection, depending on the chosen method, adds $8,000–$40,000 per lane for optical turnstiles, $5,000–$15,000 for a mantrap vestibule, or $1,500–$4,000 per door for video analytics integration.
A project that specifies “anti-passback and tailgating detection at all lobby entry points” and bids only the access control hardware for anti-passback (two readers per door) has under-specified the bid. The change order arrives when the turnstile or mantrap hardware is priced after award. Access control panel capacity planning is where this also surfaces: turnstile lanes require significantly more I/O points per lane than a standard door, and a panel sized for standard door counts may not have the I/O capacity for optical turnstile integration without an expansion module.
Mobile credentials and the anti-passback dimension
Mobile credentials add a complication to anti-passback enforcement that badge-based systems avoid: BLE-based credentials are subject to relay attacks that can cause the access system to record an entry event when the credential holder is physically not at the door. A relay attack that records a fraudulent entry event corrupts the anti-passback zone state for that credential, causing false anti-passback violations when the user next presents their credential at the actual door. The mobile credentials security post covers BLE relay attack mechanics and the deployment configurations that mitigate them — relevant context for any system where mobile credentials are being deployed in zones that also use anti-passback enforcement.
Combined deployments — when both are specified correctly
The correct combined specification for a lobby entry requiring both controls is: optical turnstile lanes (tailgating prevention) with exit readers integrated into the turnstile (anti-passback tracking). The turnstile physically prevents tailgating; the exit reader records the exit event that keeps anti-passback state accurate. Without the exit reader, the system loses credential state every time a user exits through the turnstile, leading to false anti-passback violations when users try to enter the next morning after an untracked overnight exit.
For secondary doors where turnstile cost is not justified but credential sharing is a concern, anti-passback with hard enforcement and a two-reader configuration is the right specification. The OSDP vs Wiegand reader comparison is relevant here: two-reader doors double the reader count on the access panel, and a retrofit from Wiegand to OSDP at the same time as an anti-passback upgrade is a natural pairing that improves both the anti-passback enforcement path and the overall reader security. Our access control services for Atlanta and Southeast commercial buildings include the combined specification development that ensures the hardware for anti-passback and tailgating detection is planned, costed, and coordinated with the panel capacity before the bid is issued.
Specifying access control in Atlanta or the Southeast?
We design and install access control systems for commercial buildings in Atlanta and the Southeast — including the combined anti-passback and tailgating detection specifications that ensure both requirements are met with the right hardware before the bid is issued.