A method for administering a physical access control system, the method comprising: receiving sensor data from one or more sensors deployed in a facility, the sensor data including information describing at least one of a user's activity within a zone of the facility or the user 's movement between zones of the facility; comparing the sensor data to one or more user models that describe at least one of a normal or expected user activity within the zone of the facility or normal or expected user movement between the zones of the facility; based on the comparison of the sensor data to the one or more user models, determining that the user's activity does not fall within at least one of the normal or expected user activity within the zone of the facility or the normal or expected user movement between the zones of the facility; in response to determining that the user's activity does not fall within at least one of the normal or expected user activity within the zone of the facility or the normal or expected user movement between the zones of the facility, decreasing a trust level assigned to the user for the physical access control system; and in response to decreasing the trust level assigned to the user, increasing authentication requirements for the user to gain access to at least one secured asset; characterised in that at least one of the normal or expected user activity within the zone of the facility or the normal or expected user movement between the zones of the facility comprises at least one of: (i) a predetermined number of steps the user is expected to take within a particular zone of the facility; or (ii) a predetermined number of steps taken between zones of the facility. receiving sensor data from one or more sensors deployed in a facility, the sensor data including information describing at least one of a user's activity within a zone of the facility or the user 's movement between zones of the facility; comparing the sensor data to one or more user models that describe at least one of a normal or expected user activity within the zone of the facility or normal or expected user movement between the zones of the facility; based on the comparison of the sensor data to the one or more user models, determining that the user's activity does not fall within at least one of the normal or expected user activity within the zone of the facility or the normal or expected user movement between the zones of the facility; in response to determining that the user's activity does not fall within at least one of the normal or expected user activity within the zone of the facility or the normal or expected user movement between the zones of the facility, decreasing a trust level assigned to the user for the physical access control system; and in response to decreasing the trust level assigned to the user, increasing authentication requirements for the user to gain access to at least one secured asset; characterised in that at least one of the normal or expected user activity within the zone of the facility or the normal or expected user movement between the zones of the facility comprises at least one of: (i) a predetermined number of steps the user is expected to take within a particular zone of the facility; or (ii) a predetermined number of steps taken between zones of the facility. (i) a predetermined number of steps the user is expected to take within a particular zone of the facility; or (ii) a predetermined number of steps taken between zones of the facility.