What the Access Rights Object Is
The Access Rights object, defined in Clause 12.34 of ANSI/ASHRAE 135-2024, is how a BACnet device represents a collection of access rules: the privileges for entering and leaving access-controlled zones or reaching other resources. One or many credentials can share the same Access Rights object, which is what makes role-based access control possible.
The object holds negative and positive rules. A negative rule specifies where and when access is denied; a positive rule specifies where and when access may be granted. Negative rules take precedence, and all negative rules assigned to a credential are evaluated before any positive rule. Each rule names a location (an access point or zone), a condition that decides whether the rule applies right now (often the Present_Value of a Schedule object), and an enable flag. This object has no intrinsic-reporting properties.
Where You’ll See It
- Role definitions. A “day-shift staff” or “contractor” role is one Access Rights object referenced by every credential in that role.
- Time-based access. A rule whose condition is a Schedule grants access only during configured hours.
- Accompaniment. A rule set can require an accompanying credential, so a visitor is only granted access while escorted.
Required Properties
Clause 12.34 requires every Access Rights object to provide these properties. Datatypes are the spec’s names: BOOLEAN is a true/false flag, Unsigned an integer, and the BACnet-prefixed types are structured values defined by the standard.
| Property | Datatype | What it holds |
|---|---|---|
Object_Identifier | BACnetObjectIdentifier | The object’s type and instance number, unique within the device |
Object_Name | CharacterString | The human-readable point name, unique within the device |
Object_Type | BACnetObjectType | Always access-rights for this object |
Global_Identifier | Unsigned | A shared identifier for the rights set when represented in several devices. Writable |
Status_Flags | BACnetStatusFlags | Four health flags: in-alarm, fault, overridden, out-of-service |
Reliability | BACnetReliability | Names the reason whenever the fault flag is set |
Enable | BOOLEAN | Whether this entire rights set is currently active |
Negative_Access_Rules | BACnetARRAY[N] of BACnetAccessRule | The rules that deny access, evaluated first |
Positive_Access_Rules | BACnetARRAY[N] of BACnetAccessRule | The rules that may grant access |
Property_List | BACnetARRAY[N] of BACnetPropertyIdentifier | The list of properties this instance actually implements |
Optional Properties
The property integrators meet most is Accompaniment, which sets a requirement for an escorting credential. Audit_Level and Auditable_Operations are the audit-logging controls added in 135-2024.
| Property | Datatype | Group |
|---|---|---|
Description | CharacterString | General |
Accompaniment | BACnetDeviceObjectReference | Access model |
Reliability_Evaluation_Inhibit | BOOLEAN | Fault detection |
Audit_Level | BACnetAuditLevel | Auditing |
Auditable_Operations | BACnetAuditOperationFlags | Auditing |
Tags | BACnetARRAY[N] of BACnetNameValue | Tagging and profile |
Profile_Location | CharacterString | Tagging and profile |
Profile_Name | CharacterString | Tagging and profile |
Related Objects
- Access Credential: the credential that references this rights set to decide where it may go.
- Access User: the person or group whose credentials carry these rights.
- Access Point: the point that evaluates these rules during authorization.
What Chipkin Provides
The Access Rights object, including its positive and negative rule model for role-based access control, is a first-class object type in the CAS BACnet Stack. Talk to us about modeling your device’s points.