Continuing from Part 1. This round is the access-control layer itself and where it all lands.
Door hardware — a “Push to Exit” REX button set into the wall by each secured door, and standard mechanical deadbolts kept in place as a fallback (UniFi Access controls the electric strike, the physical lock is still there if the network layer goes down).
Head-end lives in a ceiling utility space, not a server room — a small wall-mounted rack cabinet holds the switch and a UDM-class controller, an AP is Ethernet-fed off the same drop, and a NAS sits alongside for local video/log retention. Ran conduit for the low-voltage runs rather than open cable, which cost more time up front and saved a lot of hassle troubleshooting later.
Lessons so far: plan your reader mounting height and REX placement before drywall goes back up, not after — one of ours needed a second cut. UDM-class gear in a ceiling space needs real thought about heat; ours has passive venting and we’re watching temps over the first month.