What the Access User Object Is
The Access User object, defined in Clause 12.33 of ANSI/ASHRAE 135-2024, is how a BACnet device represents a user of a physical access-control system: an individual person, a group of users, or an asset. It supports relationships between users so that companies, departments, and ownership hierarchies can be represented.
The Access User object is not directly involved in authentication or authorization. It is informational: it holds a name, an external reference number, and a link to an outside system that carries the person’s details. It references the Access Credential objects assigned to the user, which lets an operator act on all of a person’s credentials at once (for example, disabling them together). This object has no intrinsic-reporting properties.
Where You’ll See It
- Cardholder records. Each enrolled person on an access controller can be an Access User object linked to the credentials issued to them.
- Organizational grouping. Department or company groupings use
MembersandMember_Ofto model who belongs to what. - Asset tracking. A tracked asset that carries a credential is represented as an Access User of the asset type.
Required Properties
Clause 12.33 requires every Access User object to provide these properties. Datatypes are the spec’s names: Unsigned is an integer, BOOLEAN a true/false flag, and the BACnet-prefixed types are structured values defined by the standard.
| Property | Datatype | What it holds |
|---|---|---|
Object_Identifier | BACnetObjectIdentifier | The object’s type and instance number, unique within the device |
Object_Name | CharacterString | The human-readable point name, unique within the device |
Object_Type | BACnetObjectType | Always access-user for this object |
Global_Identifier | Unsigned | A shared identifier for the user when represented in several devices. Writable |
Status_Flags | BACnetStatusFlags | Four health flags: in-alarm, fault, overridden, out-of-service |
Reliability | BACnetReliability | Names the reason whenever the fault flag is set |
User_Type | BACnetAccessUserType | Whether this record is a person, a group, or an asset |
Credentials | BACnetLIST of BACnetDeviceObjectReference | The Access Credential objects assigned to this user |
Property_List | BACnetARRAY[N] of BACnetPropertyIdentifier | The list of properties this instance actually implements |
Optional Properties
The properties integrators meet most are the identity fields (User_Name, User_External_Identifier, User_Information_Reference) and the grouping references (Members, Member_Of). Audit_Level and Auditable_Operations are the audit-logging controls added in 135-2024.
| Property | Datatype | Group |
|---|---|---|
Description | CharacterString | General |
User_Name | CharacterString | Access model |
User_External_Identifier | CharacterString | Access model |
User_Information_Reference | CharacterString | Access model |
Members | BACnetLIST of BACnetDeviceObjectReference | Access model |
Member_Of | BACnetLIST of BACnetDeviceObjectReference | Access model |
Reliability_Evaluation_Inhibit | BOOLEAN | Fault detection |
Audit_Level | BACnetAuditLevel | Auditing |
Auditable_Operations | BACnetAuditOperationFlags | Auditing |
Tags | BACnetARRAY[N] of BACnetNameValue | Tagging and profile |
Profile_Location | CharacterString | Tagging and profile |
Profile_Name | CharacterString | Tagging and profile |
Related Objects
- Access Credential: the credentials assigned to this user and carried through a door.
- Access Rights: the rule sets a credential references to decide where it may go.
- Access Point: where a user’s credential is authenticated and authorized.
What Chipkin Provides
The Access User object, including its credential links and organizational grouping, is a first-class object type in the CAS BACnet Stack. Talk to us about modeling your device’s points.