A failure of physical or logical access controls—authentication, authorization, or enforcement mechanisms—such that an actor gains unauthorized entry, use, or ability to manipulate assets, systems, or locations within the protected domain.

Principle

Access control integrity depends on the joint operation of authentication, authorization, and enforcement plus detectable audit; compromise of any element or of audit/log integrity permits unauthorized actions to proceed undetected or unmitigated.

Demonstration

Illustrative scenario — Situation: A secure facility requires badge authentication and logging. Recognition: A cloned credential is used to enter the server room outside scheduled hours. Action: The adversary accesses and tampers with hardware. Consequence: Data exfiltration and system disruption occur before audits detect the breach due to delayed log review.

Misapplication

Labeling all instances of unauthorized presence (e.g., a visitor who tailgates a door during an event) as an access-control compromise of the security system itself. The error is failing to distinguish human‑factor procedural breaches from technical failures of control mechanisms.

Consequence

Compromise enables theft, sabotage, persistence, lateral movement, privilege escalation and undermines trust in security claims; it also increases the operational and forensic cost of containment and recovery.

Reversal

Access observed without prior authorization is not always a compromise when it follows predefined emergency override, lawful warrant, or time‑limited maintenance with authenticated privilege escalations and audit artifacts; in these cases, integrity remains intact if controls recorded and authorized the action.

Boundary

Clearly within: credential forgery that bypasses authentication and allows system modification. Boundary case: unattended door propped open enabling entry—physical security failure that may or may not imply systemic control compromise. Clearly outside: planned authorized access under documented procedures and visible audit trails.

Semantic Tension

Strict security controls and the need for operational availability/usability—stronger controls reduce convenience and can drive unsafe workarounds or shadow credentials.

Synthesis

Mitigation requires layered defenses (defense‑in‑depth), tamper‑resistant logging and rapid audit/response; distinguishing procedural violations from technical compromise is essential to prioritize response and remediation.