A multi-tenant commercial building presents a security problem that single-occupancy buildings do not: the perimeter is shared but the risk tolerance is not. The common failure is a single visitor register at the main gate. A visitor writes a name, a destination and a signature that nobody verifies, and proceeds unescorted into a building housing twelve organisations with varying sensitivity. A structured approach separates building access from tenant access. Building-level screening verifies identity and records entry. Tenant-level authorisation confirms that the visitor is expected and determines whether escort is required. The second step is where most buildings have no process at all. Pre-registration changes the dynamic substantially. When a host registers an expected visitor in advance, the gate verification becomes a confirmation rather than an interrogation, throughput improves, and unexpected visitors become visible by exception. Contractor and vendor access deserves separate treatment. Service personnel frequently carry tools, access service corridors and work unsupervised in plant areas. A permit-to-work process with defined validity, area restriction and sign-out requirement is standard practice in industrial settings and increasingly expected in commercial ones. Material movement controls, both inward and outward, prevent the most common form of loss in commercial buildings. A gate pass system for outbound equipment, enforced consistently regardless of the seniority of the person carrying the item, is simple and effective. The measure of an access control system is not the technology deployed but whether a guard will stop a confident, well-dressed person who has no appointment.