Is anyone successfully mapping electronic cardholder groups to a mechanical grand master hierarchy without exceptions piling up? I’m managing 11 access tiers across 4 buildings and about 620 SFIC cores, and contractor/night-shift overrides keep eroding least privilege — do you enforce a strict 1:1 binding between change-key levels and card groups, or insert a temporary-access layer with auto-expiry?