A facility, comprising: a plurality of access control modules located within the facility, a first access control module of the access control modules comprising: an access control logic configured to make a determination to either permit or deny user access to an asset controlled by the access control module wherein the access control logic provides the access control module with the ability to read access data from credentials and make the determination as to whether or not the holder of the credential is allowed to access any assets controlled by the access control module; and a check-in module configured to receive a credential identifier from an access credential, compare the credential identifier to a list of credential identifiers stored in the first access control module, determine that the credential identifier matches at least one credential identifier in the list of credential identifiers, and, based on determining that the credential identifier matches at least one credential identifier in the list of identifiers, invoke the first access control module to encode the access credential with access data that comprises a set of access permissions defining whether the access credential is permitted or denied access to particular assets of the facility wherein the check-in module is configured to invoke the access control module to encode the access credential with the access data after determining that the credential identifier matches at least one credential identifier in the list of identifiers and wherein the check-in module is further configured to, after determining that the credential identifier matches at least one credential identifier in the list of identifiers, confirm that the access credential has been successfully encoded with the access data, remove the credential identifier from the list of identifiers and report a successful check-in to a central access control logic. a plurality of access control modules located within the facility, a first access control module of the access control modules comprising: an access control logic configured to make a determination to either permit or deny user access to an asset controlled by the access control module wherein the access control logic provides the access control module with the ability to read access data from credentials and make the determination as to whether or not the holder of the credential is allowed to access any assets controlled by the access control module; and a check-in module configured to receive a credential identifier from an access credential, compare the credential identifier to a list of credential identifiers stored in the first access control module, determine that the credential identifier matches at least one credential identifier in the list of credential identifiers, and, based on determining that the credential identifier matches at least one credential identifier in the list of identifiers, invoke the first access control module to encode the access credential with access data that comprises a set of access permissions defining whether the access credential is permitted or denied access to particular assets of the facility an access control logic configured to make a determination to either permit or deny user access to an asset controlled by the access control module wherein the access control logic provides the access control module with the ability to read access data from credentials and make the determination as to whether or not the holder of the credential is allowed to access any assets controlled by the access control module; and a check-in module configured to receive a credential identifier from an access credential, compare the credential identifier to a list of credential identifiers stored in the first access control module, determine that the credential identifier matches at least one credential identifier in the list of credential identifiers, and, based on determining that the credential identifier matches at least one credential identifier in the list of identifiers, invoke the first access control module to encode the access credential with access data that comprises a set of access permissions defining whether the access credential is permitted or denied access to particular assets of the facility wherein the check-in module is configured to invoke the access control module to encode the access credential with the access data after determining that the credential identifier matches at least one credential identifier in the list of identifiers and wherein the check-in module is further configured to, after determining that the credential identifier matches at least one credential identifier in the list of identifiers, confirm that the access credential has been successfully encoded with the access data, remove the credential identifier from the list of identifiers and report a successful check-in to a central access control logic.