An access control system, comprising: a credential service operable to generate an encrypted mobile credential comprising an identifier and virtual card data, the credential service operable to generate a set of encrypted mobile credentials from a permission, wherein the permission specifies access rights for a user to an access control and an access category, and the access category is associated with one or more additional access controls so that the set contains a respective encrypted mobile credential for each access control; a mobile application comprising a mobile library on a mobile device operable to communicate with the credential service, the mobile application operable to establish communication of the mobile library with the credential service, the mobile library operable to receive the set of encrypted mobile credentials from the credential service, the mobile library operable to receive an advertisement data from the access control or the one or more additional access controls; and a credential module of the access control that is operable to advertise its presence on a periodic rate with the advertisement data that indicates an identifier of the access control such that the mobile library is operable to compare the identifier of the access control with identifiers in the set of encrypted mobile credential and send, based on the comparing, the encrypted mobile credential of the access control to the credential module when the mobile application instructs the mobile library to send the encrypted mobile credential to the credential module, the credential module operable to extract virtual card data from the encrypted mobile credential and send the virtual card data to a controller of the access control, wherein the credential module is operable to decrypt and validate the encrypted mobile credential within the credential module by validating a starting date and an expiring date associated with the encrypted mobile credential. a credential service operable to generate an encrypted mobile credential comprising an identifier and virtual card data, the credential service operable to generate a set of encrypted mobile credentials from a permission, wherein the permission specifies access rights for a user to an access control and an access category, and the access category is associated with one or more additional access controls so that the set contains a respective encrypted mobile credential for each access control; a mobile application comprising a mobile library on a mobile device operable to communicate with the credential service, the mobile application operable to establish communication of the mobile library with the credential service, the mobile library operable to receive the set of encrypted mobile credentials from the credential service, the mobile library operable to receive an advertisement data from the access control or the one or more additional access controls; and a credential module of the access control that is operable to advertise its presence on a periodic rate with the advertisement data that indicates an identifier of the access control such that the mobile library is operable to compare the identifier of the access control with identifiers in the set of encrypted mobile credential and send, based on the comparing, the encrypted mobile credential of the access control to the credential module when the mobile application instructs the mobile library to send the encrypted mobile credential to the credential module, the credential module operable to extract virtual card data from the encrypted mobile credential and send the virtual card data to a controller of the access control, wherein the credential module is operable to decrypt and validate the encrypted mobile credential within the credential module by validating a starting date and an expiring date associated with the encrypted mobile credential.