Access Rights

An Access Rights object is a reusable set of rules that says where and when credentials may pass. Many credentials can share one object, which supports role-based access. Each rule can allow or deny, and denials always win.

Typical uses

• A ‘staff’ role allowed in during office hours
• A ‘cleaners’ role allowed in only at night
• A rule that denies entry to a restricted lab
• A contractor role limited to one building wing

Key properties

Property	What it holds
Enable	Turns the whole rule set on or off.
Positive_Access_Rules	The list of rules that grant access to a point or zone, each with a time condition and its own enable flag.
Negative_Access_Rules	The list of rules that deny access. They are checked before any positive rule.
Accompaniment	Names a credential that must accompany the holder, when the rights require an escort.

How it behaves

The standard gives this type no event algorithm. A credential references the object; an Access Point evaluates the rules when someone presents the credential.

With the CAS BACnet Stack

Enable it with the STACK_OPTION_OBJECT_TYPE_ACCESS_RIGHTS build option and add each object with BACnetStack_AddObject. You serve the rule lists and other properties through your property callbacks.

Related object types

Access Credential, Access Point, Access Zone

Properties

The properties ASHRAE 135-2024 clause 12.34 defines for this object type.

How to read the table:

• Conformance is what the standard asks of every object of this type: R is required, W is required and writable by a client, O is optional. A digit after the letter marks a condition in the standard that decides when the property is present or writable, such as support for intrinsic reporting.
• Present by default: yes means the stack presents the property as soon as you add the object; no means it is optional and you turn it on with BACnetStack_SetPropertyEnabled. This is the stack’s starting setup, so it can differ from the conformance code.
• Writable is whether a client can write the property by default. Change it with BACnetStack_SetPropertyWritable.
• not in profile means the stack does not offer this property for this object type.
• Value when your callback does not answer: “Held by the stack” means the stack stores and serves the value itself and does not ask your callbacks. Otherwise it is the value the stack answers when your callback declines or is not registered.

Property	Datatype	Conformance	Present by default	Writable	Value when your callback does not answer
Object_Identifier	BACnetObjectIdentifier	R	yes	no	Held by the stack.
Object_Name	CharacterString	R	yes	no	"Object <type>,<instance>", such as "Object 0,1" for Analog Input 1.
Object_Type	BACnetObjectType	R	yes	no	Held by the stack.
Description	CharacterString	O	no	no	""
Global_Identifier	Unsigned32	W	yes	yes	0
Status_Flags	BACnetStatusFlags	R	yes	no	Built by the stack from your callbacks.
Reliability	BACnetReliability	R	yes	no	0
Enable	Boolean	R	yes	no	false
Negative_Access_Rules	BACnetARRAY[N] of BACnetAccessRule	R	yes	no	No default: the read fails.
Positive_Access_Rules	BACnetARRAY[N] of BACnetAccessRule	R	yes	no	No default: the read fails.
Accompaniment	BACnetDeviceObjectReference	O	no	no	No default: the read fails.
Reliability_Evaluation_Inhibit	Boolean	O	no	no	false
Property_List	BACnetARRAY[N] of BACnetPropertyIdentifier	R	yes	no	Held by the stack.
Audit_Level	BACnetAuditLevel	O1	not in profile	not in profile	No default: the read fails.
Auditable_Operations	BACnetAuditOperationFlags	O1	not in profile	not in profile	No default: the read fails.
Tags	BACnetARRAY[N] of BACnetNameValue	O	no	no	No default: the read fails.
Profile_Location	CharacterString	O	no	no	""
Profile_Name	CharacterString	O	no	no	""