# Separate Genetec global cardholder membership from local access rules > Genetec GCM does not inherit partition membership from parent entities, and access rules remain local. Review sharing membership and door authorization as separate decisions. - Canonical URL: https://update.dsesecurity.com/updates/separate-genetec-global-cardholder-membership-from-local-access-rules/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-28T23:23:27+00:00 - Modified: 2026-10-28T23:23:38+00:00 - Last reviewed by DSE: 2026-10-28 - Resource type: Guide - DSE priority: Advisory - Topics: Access Control, IT - Reading time: 3 minutes ## What you need to know Genetec GCM does not inherit partition membership from parent entities, and access rules remain local. Review sharing membership and door authorization as separate decisions. ## Potentially affected Security Center 5.14 systems implementing Global Cardholder Management with sharing hosts and guests. ## DSE recommendation Register explicit global membership and local access-rule ownership, then verify both replication and effective access with approved test identities. ## Article Bottom line: Approve which identities become global separately from the local access rules that govern their use at each facility. ## Source fact: documented behavior The [Rules and restrictions for Global cardholder management](https://techdocs.genetec.com/r/en-US/Security-Center-Administrator-Guide-5.14/Rules-and-restrictions-for-Global-cardholder-management) topic is the primary reference for this Security Center 5.14 discussion. Genetec’s Security Center 5.14 rules state that partition membership is not inherited from parent entities. A cardholder does not become global merely because its parent cardholder group is in a global partition. Access rules are not shared, although local access rules can apply to local and global cardholders. Adding a local entity to a global partition transfers ownership from the sharing guest to the sharing host. A guest’s add, modify or delete operation on an entity in a global partition applies to all systems sharing that partition. ## What the source does not establish These are GCM data and ownership rules for the documented release. They do not establish that a customer’s identities are correctly shared or that a door grant is authorized. Keep operator privilege configuration, identity replication and the facility’s approved access policy distinct in the review. ## Applicability questions - Which system is the sharing host, and which are the sharing guests? - Which cardholders and groups are explicitly members of the global partition? - Which local access rules apply to those identities at each site? - Who may change shared entities, and who approves the resulting ownership transfer? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. DSE recommends a sharing register that follows the actual objects rather than relying on a group’s name or location in a tree. - List the intended global cardholders and groups individually, their current owner and their proposed partition membership. Have each facility owner identify the local access rules that should apply after sharing. - Pilot with approved test identities. Include a member of a shared parent group whose own global membership has not been added, then a deliberately shared identity. Compare the actual entity state with the intended sharing register before changing a larger population. - Review a permitted change to a shared test entity with the affected site owners. Record where the change appears and reconcile local access decisions separately. Resolve unexpected ownership or access results before extending the sharing configuration. ## Verification and evidence Retain the sharing topology, explicit membership and ownership records, authorized role scope, local rule assignments and dated observations from the host and guests. Use ordinary approved access-testing procedures for positive and negative cases at the relevant facilities. Obtain separate acceptance for shared-data correctness and local access behavior. Recheck after partition, ownership, sharing-account or directory-integration changes. These are proposed DSE checks; the article does not report a tested customer synchronization or authorize a new access entitlement. ## Official references - [Rules and restrictions for Global cardholder management](https://techdocs.genetec.com/r/en-US/Security-Center-Administrator-Guide-5.14/Rules-and-restrictions-for-Global-cardholder-management) — Genetec; Security Center 5.14. Source review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change. ## Primary reference - Name: Genetec — Rules and restrictions for Global cardholder management (Security Center 5.14) - Authority: Genetec - URL: https://techdocs.genetec.com/r/en-US/Security-Center-Administrator-Guide-5.14/Rules-and-restrictions-for-Global-cardholder-management - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Separate Genetec global cardholder membership from local access rules,” DSE Security, https://update.dsesecurity.com/updates/separate-genetec-global-cardholder-membership-from-local-access-rules/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.