Access Control Vestibules: What They Solve, When to Use One

An access control vestibule, also called a mantrap, is a small enclosed space between two interlocking doors, where the second door stays locked until the first has closed and the person inside has been authorized. It exists to stop tailgating: one valid credential letting two people into a space that should only admit one.

What an Access Control Vestibule Is

Physically, a vestibule is a short corridor or booth with a door at each end. The two doors are wired to an interlock, so they can never be open at the same time. You badge in through the outer door, it closes behind you, and only then can the inner door release. If something about you or your credential fails a check while you are inside, the inner door stays shut and you are standing in a holding space instead of inside the building.

You will see the same thing called a mantrap, a security vestibule, an airlock entry or a sally port, depending on who built it and which industry they came from. The standards language is "access control vestibule." NIST Special Publication 800-53 Revision 5 uses that term for control PE-3(8), Access Control Vestibules, whose control statement reads: "Employ access control vestibules at [Assignment: organization-defined locations]." The discussion that accompanies the control gives mantrap as the plain-English equivalent.

That federal framing matters if you work in or for a regulated environment. When an auditor asks how a sensitive space meets PE-3(8), a vestibule is the literal answer the control names.

The Problem a Vestibule Actually Solves

Tailgating is following an authorized person through a controlled door. Many security teams split it in two: tailgating is when the authorized person does not know or does not agree, and piggybacking is when they hold the door on purpose for someone they think belongs there. NIST's discussion of PE-3(8) treats the two words as one activity, and at the door the result is the same either way: an unauthorized person inside. We break down the difference in more detail in our guide to tailgating vs. piggybacking.

Here is the structural problem. A card reader authorizes a credential, not a body. One valid swipe unlocks the door for a set number of seconds, and anyone who walks through in that window is invisible to the access control log. The log shows one access granted. It is accurate about the credential and silent about the second person, because that is all the system was designed to record.

The industry knows this is a gap and mostly does not measure it. In a 2019 Boon Edam survey of more than 185 end users and security advisors across the US and Canada, 74% of end users said they do not track tailgating, while 71% of the same end users said they believe they are vulnerable to a physical breach from tailgating. Those are perception figures from end users, not breach rates, and they are seven years old. What they show is the shape of the problem: most organizations believe the gap is there and have no record of how often it is used.

A vestibule closes the gap physically. Two people cannot pass on one credential if the space only releases its inner door for one authorized person at a time.

How the Interlock Works, Step by Step

The interlock is the whole mechanism. Everything else in a vestibule, the readers, the sensors, the camera, feeds a single rule: the inner door cannot open while the outer door is open, and it cannot open until the person inside has passed whatever check the space requires.

A typical cycle looks like this:

1. The person presents a credential at the outer door reader, and the outer door unlocks.
2. They step inside, and the outer door closes and relocks behind them. The interlock confirms the outer door is shut before anything else can happen.
3. Inside the vestibule, they present a second credential, or the same one again, at the inner reader. Higher-security spaces add a second factor here.
4. If that check passes and nothing else in the vestibule flags a problem, the inner door unlocks.
5. They step through, the inner door closes and relocks, and the vestibule resets for the next person.

If the check at step 3 fails, the inner door stays locked and the person is held. What happens next is a design decision you make in advance: the outer door can release so they can leave the way they came, or both doors can stay locked until security arrives. Either way, someone has to be told. The alert should go to whoever staffs the security desk or monitoring station, with enough context to decide whether this is a forgotten PIN or something worse.

NIST's discussion of the control describes two ways to run the interlock. In a fully automated vestibule, the controller opens and closes the doors on its own based on authorization. In a partially automated one, security guards control how many people enter the holding space. Guard-controlled flow suits entrances that already have a person stationed at them, such as a government building lobby.

Where a Vestibule Earns Its Cost

A vestibule is the most complete answer to tailgating and the most expensive one, so the useful question is whether a given door is worth it. Here is how it compares with the other ways to control a single entry point.

Optical turnstiles and speed gates are a separate decision with their own buyer and tradeoffs, which we cover in our guide to access control turnstiles. The vestibule wins in places where the consequence of one wrong person getting in is serious enough to justify slowing every right person down.

Data Centers and Network Rooms

A data center typically has one entry to the data hall and a small, known population of staff and contractors who pass through it. Traffic is low and steady, so the throughput penalty is small, and an auditor working from NIST SP 800-53 can ask for exactly this control by name. One vestibule in front of the hall protects the room that matters most.

Cash and Vault Rooms

Cash rooms, counting rooms and vaults have a handful of authorized people and an obvious motive for someone to follow them in. A camera alert after the fact is too late when the loss is immediate. One vestibule at the single door into the room keeps a follower out at the moment it matters, when a recording would only show the loss afterward.

Clean Rooms and Controlled Manufacturing

Clean rooms already use airlock-style entries to control contamination, so the architecture is often half-built. Adding an access interlock to an existing gowning airlock limits entry to trained, authorized staff at the one door into the controlled space. The population is small and the cost of an untrained person walking in is high.

Single-Entry School and Government Lobbies

Many schools and government buildings funnel all visitors through one main entrance. A secure vestibule there lets staff hold a visitor between two doors while they check identity, without letting that person into the building first. It covers one door, the busiest public entry, and it is often the only place in the building where a vestibule is worth building.

What a Vestibule Costs You

The previous section is the case for a vestibule. This one is the bill. Every vestibule takes three things from you, and if you leave them out of the planning, they come back as a queue, a failed inspection or a door people learn to prop open.

Throughput

A two-door interlock moves one person per cycle, and the cycle includes both doors opening, closing and relocking. That is a hard ceiling, not a setting. No reader upgrade gets more people through a space built to hold one.

Vendor cycle times vary with door type, credential and how quickly people move, so do the arithmetic for your own building rather than trusting a brochure number. Count how many people arrive at that door in the busiest fifteen minutes of the day, usually shift change or the start of the school day. Divide by the cycle time the vendor quotes for the exact configuration you are buying. If the answer is longer than fifteen minutes, the queue will reach the parking lot, and people will start looking for another door.

That last point is the real risk. A vestibule that is too slow does not stop tailgating. It moves it to the side door next to it.

Construction and Egress Code

A vestibule is a construction project. It needs floor space you may not have in an existing lobby, two door openings with frames and hardware, power for both locks and the controller, and a life-safety review before anyone signs off. In an existing building, that usually means an architect, a contractor and a permit.

The egress requirement is the one that catches people out. A space designed to hold people between two locked doors has to let them out when the fire alarm goes off. How the interlock releases, and what the fire alarm annunciator and fire alarm control panel do during an alarm, is governed by the fire code your jurisdiction has adopted. The fire code official approves it. Bring them into the design early, because their answer can change which doors you can lock and how.

Accessibility

A vestibule has to work for a wheelchair user and for someone using a walker. That means enough clear floor area inside for a wheelchair user with both doors closed, enough maneuvering clearance at each door, and a cycle timing that does not close a door on someone who moves slowly.

These are not details to fix after the space is built. Once the walls are up, a vestibule that is too small cannot be made bigger without rebuilding it. Put the accessibility review in the drawing set, not the punch list, and route it through your own architect against the accessibility standard that applies to your building.

Covering the Doors That Will Never Have a Vestibule

Most buildings that get a vestibule get exactly one, at the main entrance or in front of the most sensitive room. Everything else stays an ordinary controlled door: side entrances, stairwells, loading docks and the door between the lobby and the offices. Tailgating at those doors does not stop because the front door has a mantrap. If anything, it concentrates there.

Those doors need a layered answer built from sensors you may already have. A door position indicator tells the system when a door is physically open, so a door held open past its time shows up as an event. A request-to-exit sensor tells the system when a legitimate exit is happening, so someone walking out is not logged as a forced door. And a camera linked to the door lets you compare the one unlock event in the log with the number of people who actually walked through.

That last piece is where Coram Access Control comes in. Coram detects tailgating by combining access control event data with camera footage from the door. A tailgating event occurs when two or more people pass through a door on a single valid credential event. Because detection is video-based, a camera must be associated with each door you want to monitor, and doors without an associated camera do not appear in the alert setup and cannot be monitored for tailgating at all. The same doors can also raise a held-open alert when the door stays open longer than the time set in its settings, which requires a door position indicator installed and enabled on the door, and a forced-open alert, which needs request-to-exit enabled so legitimate exits are not flagged.

The operational point is the clip. Alert activity appears in the Coram Alerts Feed with camera footage showing the access event and the detected tailgating. A tailgating log line with no video is a line nobody investigates, because checking it means pulling footage from another system and finding the right minute. An alert with the clip attached can be judged in seconds, so it actually gets looked at.

Specifying a Vestibule: What to Put in the Drawing Set

If one of your doors earns a vestibule, the quality of the result is decided in the drawings, long before the first door is hung. Most problems with vestibules (the queue, the failed inspection, the space that is too small) trace back to something nobody wrote down at design stage.

This checklist is for the conversation with your architect and your integrator. Each item is a decision someone has to make on paper, and it is cheaper to make it there than on site.

1. Interior clear dimensions. State the clear floor area inside the vestibule and confirm it holds the accessibility clearance your architect has specified, with both doors closed.
2. Interlock controller and failure mode. Name the controller, how it sequences the doors, and what each door does on power loss and on controller failure. Decide what the interlock does during a lockdown, too, so it does not trap people or open the building.
3. Credential at each door. Specify what the outer and inner readers accept, whether that is a card, a fob, a mobile credential, a PIN or a second factor at the inner door. If you are weighing biometric credentials at the door, decide which door carries them.
4. Camera position and field of view. Mark where the camera sits inside the vestibule and what it must see, so every cycle is recorded and a second person in the space is visible.
5. Fire alarm release path. Show how the interlock releases on a fire alarm, which device signals it and who signs off on it. That is the fire code official, not the installer.
6. Intercom or duress path. Give anyone held inside a way to reach a person, whether an intercom to the security desk or a duress button, and say who answers.
7. Queueing space outside the outer door. Allocate enough room outside the outer door for the peak-time queue you calculated, so people waiting do not block a corridor or an exit route.

Hand the list to both the architect and the integrator, and ask each of them to mark which items are theirs. Anything both of them think belongs to the other is the item that will be missing at handover.

Building the Case: Where Vestibules Fit a Layered Entry Plan

A vestibule is the right tool for the one or two doors where a single wrong entry costs too much, and the wrong tool for the rest of the building. Build one where the risk and the traffic justify it, and cover every other controlled door with a door position sensor, a request-to-exit sensor and a camera linked to the door. In most buildings, that means one vestibule protecting one door, and detection covering the dozens of doors that will never get one. When you compare platforms for that second layer, start with how the access control vendors compare.