On May 14, Brivo did something I believe is the first domino to fall in the access control space.

They announced that their Security Platform API was now AI-native. They rolled out the llms.txt standard across their entire video and access control documentation, meaning the API isn't just open to developers. It's open to AI agents that can build against it and ship integrations on their own.

We've all sat through the last few years of ISC West, where every booth touted "AI" everything. Most of it was analytics or machine learning dressed up as AI. This feels different.

The case study that accompanied the announcement offers a glimpse of where this is headed. An integrator used the agentic tool OpenClaw alongside the Brivo API to connect the access control platform with a non-native third-party intrusion detection system.

Their CEO was quoted as saying, "We're now at the age where your ability to develop an integration is only limited by your imagination. I described the outcome I wanted in natural language, and OpenClaw built it." 

His broader point matters more: integrators are no longer beholden to a manufacturer's roadmap. They can build their own integrations without hiring a developer, waiting years, or spending tens of thousands of dollars. I have no affiliation with Brivo. I'm just genuinely impressed by the AI native direction. The API announcement was their third move in 90 days, signaling where the company is going.

First, an AI video agent that lets operators set monitoring rules in plain English. Instead of programming detection logic, you tell the system what to watch for: "alert me when someone loiters near the back door after 9 PM," or "flag any vehicle in the parking lot after closing."

In April, they launched a mobile agent that lets security professionals execute emergency lockdowns using voice commands. A school administrator can say "lock down the building" into their phone and the system executes across every door, every reader, every credential, in real time. This is an AI agent acting on a critical security workflow. It feels like a next-gen version of what we built years ago at S2 with our Threat Level Escalator app, which allowed an operator to manually initiate a lockdown.

Access Control's Untapped Intelligence Layer

Here's the part of access control that's been talked about for years but never fully leveraged.

The systems sit atop incredibly valuable data. Every badge read is a piece of information about who's where, when, and how often. Every credential is tied to an identity, a role, a department, and a schedule. Every door event is a record. Multiply that across a multi-location enterprise with thousands of cardholders and you have one of the richest operational datasets in the building.

And almost nobody uses it.

Many companies have never thought about it. Many don't know how to leverage it. Some would love to, but don't have the time or resources to extract and organize the data into a usable format. Done right, this is the kind of data that gives security a real ROI story and shifts the department from cost center to value driver. That's what LLMs change.

Asking a question of structured data has changed forever. Once this type of AI-native ACS build becomes the norm, a security director could now ask in plain English: Which contractors still have active badges but haven't been on site in 90 days? Which employees' access patterns have shifted significantly in the last 60 days? Which terminated employees are still showing up in the system three weeks after their last day? Which doors get propped open most often, and at what times?

This is why access control is the right place for AI to land in physical security. Video has had AI longer because the use cases were visible. Cameras saw things, and AI helped them see better. But access control is where AI will be most transformative because the data is structured, identity-anchored, and directly tied to the workflows that run a business.

The badge knows who you are. The schedule knows where you're supposed to be. The integration with HR knows whether you should still have access at all. The system has always known but now it's going to become significantly easier to operationalize.

The next step is for the system to find these answers on its own and then act on them. That's where the brain metaphor stops being marketing and starts being real.

Closing the Gap Between Capability and Deployment

Anyone who has been involved in the commissioning of an access control system knows the pattern. The base programming is straightforward. The advanced capabilities are where everyone loses time: map configurations, camera-to-door associations, custom reports, schedules with exceptions inside exceptions, and third-party integrations that would actually make the system useful if anyone had the time to build them.

Most of these capabilities exist in the product. Most of them never get fully programmed.

Why? Because the integrator's hours are billable, the customer's budget is finite, and the cost of getting the "nice-to-have" features working has historically exceeded the value the customer is willing to pay. So, they don't get done. The system ships at 60% of what the customer saw in the demo, and no one is fully satisfied with the end result.

AI changes this dynamic in two ways.

First, the basics get faster. Configuring doors, building schedules, writing event logic, and generating reports. An AI agent with access to the platform's API and documentation can do in minutes what used to take hours. The integrator's time gets reclaimed for higher-value work.

Second, and more importantly, the advanced capabilities become viable.

The integrations that used to be quoted at $40,000 and six months are now quoted in hours. The custom reports that once required advanced system expertise and SQL knowledge can be generated from a natural language description. The third-party connections nobody wanted to build because the ROI wasn't there now have a path to ROI, as build costs have dropped by an order of magnitude.

A skilled integrator with AI tooling can deliver a system that's substantially more capable than what most customers are getting today, at the same cost or less. The integrators who figure this out first will have a real advantage. Those who don't will get squeezed by those who do.

And the customer wins either way.

Because what's been broken for 20 years isn't the access control product. It's the gap between what the products can do and what actually gets deployed in the field.

Making Humans Better, Not Replacing Them

I rejoined Interface Systems in March, and one of the first things that struck me was how actively our own monitoring teams are evaluating where AI can improve human intervention.

The challenge in any monitoring environment is the signal-to-noise ratio.  Alarms fire constantly. Some are false. Some are nuisance events. A few are real. The human in the chair must triage them all under pressure, often with limited context and across dozens or hundreds of sites at once. The cost of getting this wrong is operational fatigue, missed events, and burned-out staff.

AI does two things here. It reduces the volume of events that need human attention, and it gives humans better context for the ones that do.

This framing matches what we've been seeing operationally. Interface's 2026 Retail Loss Prevention Benchmark Report tracked Virtual Perimeter Guard activations across 29 distributed locations. The system was activated 23,810 times, with 96% of those threats resolved automatically through a staged voice-down protocol. Only 4% actually required escalation to a live intervention specialist.

That's AI handling the volume of routine events so humans can focus on the small percentage that actually requires judgment.

The Emergence of Autonomous Security Workflows

If the current moment is about AI accelerating access control workflows and reducing integration costs, the next three to five years could see autonomous, event-driven action across systems.

A primitive version of this already exists in the best deployments.

An employee is terminated in Workday. The HR system pushes the status change via API to the access control platform. The badge and permissions are auto-deactivated across all locations, readers, and doors. The whole loop takes seconds. That workflow is the simplest expression of a much bigger pattern. The access control system serves as the trigger for actions across the broader security and business stack.

Picture the extended version. A terminated employee's badge remains valid at any location for 2 days after their termination date. The ACS sees the attempt. It pulls the HR status. It sees the termination. It denies entry. It flags the attempt to the local manager and HR via Slack. It opens a record in the SIEM for the SOC to review. It pushes the camera feed of the attempt to the security director's phone.

Total elapsed time is under a second.

Today, that's a multi-step process that takes hours and often never gets completed.

In three to five years, on AI-native platforms, it will be automatic. The speed of response and the reduction of human involvement in routine actions are here for the right use cases. It won't happen overnight, and it won't be the right call for every action.

But in situations where the risk of being wrong is low and the cost of waiting is high, this will make a lot of sense. The actions where human judgment matters are the ones humans will keep. Drawing that line correctly is the work each organization will have to do.

The Race Toward AI-Native Access Control

The future of access control is about access control finally becoming what it could always have been: an operational intelligence system, a trigger source for cross-system action, and the identity anchor for everything else happening in a building.

The platforms making the right bets are moving fast, and I expect the legacy manufacturers will follow suit in time. The integrators adopting AI tooling are already pulling ahead. The end users who treat their PACS as a strategic data layer rather than a compliance checkbox will get more value out of their existing investment than they've gotten in the last ten years combined.

But the gap between what's possible and what's deployed is still enormous. Most operators are running systems that can't support any of this. Most integrators are still selling the old model. Most vendors are still calling machine learning "AI." The question isn't whether AI will change access control. That's already happening.