Separate Genetec global cardholder membership from local access rules

Bottom line: Approve which identities become global separately from the local access rules that govern their use at each facility.

Source fact: documented behavior

The Rules and restrictions for Global cardholder management topic is the primary reference for this Security Center 5.14 discussion.

Genetec’s Security Center 5.14 rules state that partition membership is not inherited from parent entities. A cardholder does not become global merely because its parent cardholder group is in a global partition. Access rules are not shared, although local access rules can apply to local and global cardholders. Adding a local entity to a global partition transfers ownership from the sharing guest to the sharing host. A guest’s add, modify or delete operation on an entity in a global partition applies to all systems sharing that partition.

What the source does not establish

These are GCM data and ownership rules for the documented release. They do not establish that a customer’s identities are correctly shared or that a door grant is authorized. Keep operator privilege configuration, identity replication and the facility’s approved access policy distinct in the review.

Applicability questions

• Which system is the sharing host, and which are the sharing guests?
• Which cardholders and groups are explicitly members of the global partition?
• Which local access rules apply to those identities at each site?
• Who may change shared entities, and who approves the resulting ownership transfer?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends a sharing register that follows the actual objects rather than relying on a group’s name or location in a tree.

1. List the intended global cardholders and groups individually, their current owner and their proposed partition membership. Have each facility owner identify the local access rules that should apply after sharing.
2. Pilot with approved test identities. Include a member of a shared parent group whose own global membership has not been added, then a deliberately shared identity. Compare the actual entity state with the intended sharing register before changing a larger population.
3. Review a permitted change to a shared test entity with the affected site owners. Record where the change appears and reconcile local access decisions separately. Resolve unexpected ownership or access results before extending the sharing configuration.

Verification and evidence

Retain the sharing topology, explicit membership and ownership records, authorized role scope, local rule assignments and dated observations from the host and guests. Use ordinary approved access-testing procedures for positive and negative cases at the relevant facilities.

Obtain separate acceptance for shared-data correctness and local access behavior. Recheck after partition, ownership, sharing-account or directory-integration changes. These are proposed DSE checks; the article does not report a tested customer synchronization or authorize a new access entitlement.

Official references

• Rules and restrictions for Global cardholder management — Genetec; Security Center 5.14.

Source review completed October 28, 2026. Recheck the official documentation and deployment-specific applicability before a production change.