An access control apparatus for controlling a configuration of an automation apparatus, comprising: a user interface configured to interact with a local user; an internal communication interface configured to communicate with the automation apparatus; an external communication interface configured to communicate with a network; a reader configured to read an electronic tag; and a processor, coupled with the user interface, the internal communication interface, the external communication interface, and the reader, and configured to cause the control apparatus at least to perform: reading authentication information from the electronic tag of the local user; characterized by: transmitting the authentication information to a networked service; receiving access rights from the networked service; and controlling the configuration of the automation apparatus according to the access rights received from the networked service for a role of a remote user, during a remote access by the remote user performed via the external communication interface, wherein the access rights received from the networked service for the role of the remote user comprise contact information, and a communication session is initiated via the external communication interface for the remote access based on the contact information; and terminating the remote access as a result of a user interaction via the user interface by the local user, and/or rejecting changes made during the configuration of the automation apparatus as a result of a user interaction via the user interface by the local user. a user interface configured to interact with a local user; an internal communication interface configured to communicate with the automation apparatus; an external communication interface configured to communicate with a network; a reader configured to read an electronic tag; and a processor, coupled with the user interface, the internal communication interface, the external communication interface, and the reader, and configured to cause the control apparatus at least to perform: reading authentication information from the electronic tag of the local user; characterized by: transmitting the authentication information to a networked service; receiving access rights from the networked service; and controlling the configuration of the automation apparatus according to the access rights received from the networked service for a role of a remote user, during a remote access by the remote user performed via the external communication interface, wherein the access rights received from the networked service for the role of the remote user comprise contact information, and a communication session is initiated via the external communication interface for the remote access based on the contact information; and terminating the remote access as a result of a user interaction via the user interface by the local user, and/or rejecting changes made during the configuration of the automation apparatus as a result of a user interaction via the user interface by the local user. reading authentication information from the electronic tag of the local user; characterized by: transmitting the authentication information to a networked service; receiving access rights from the networked service; and controlling the configuration of the automation apparatus according to the access rights received from the networked service for a role of a remote user, during a remote access by the remote user performed via the external communication interface, wherein the access rights received from the networked service for the role of the remote user comprise contact information, and a communication session is initiated via the external communication interface for the remote access based on the contact information; and terminating the remote access as a result of a user interaction via the user interface by the local user, and/or rejecting changes made during the configuration of the automation apparatus as a result of a user interaction via the user interface by the local user. transmitting the authentication information to a networked service; receiving access rights from the networked service; and controlling the configuration of the automation apparatus according to the access rights received from the networked service for a role of a remote user, during a remote access by the remote user performed via the external communication interface, wherein the access rights received from the networked service for the role of the remote user comprise contact information, and a communication session is initiated via the external communication interface for the remote access based on the contact information; and terminating the remote access as a result of a user interaction via the user interface by the local user, and/or rejecting changes made during the configuration of the automation apparatus as a result of a user interaction via the user interface by the local user.