Originally published in The Access Control Collection (TACC) on September 18th, 2026.

It usually takes me twenty minutes of arguing to convince security teams of this. People look at modern phones and see almighty computers. (They are).

So when the industry builds mobile access for physical doors, we naturally want the phone to do the heavy lifting. We let the mobile app hold the access token. Or worse, the actual encryption key to generate access tokens.

We treat the phone like a trusted vault.

Now we have Aliro 1.0. Apple, Google, and Samsung finally blessed it.

I am genuinely happy about this. Anyone who has shipped a mobile credential across two operating systems, four Bluetooth stacks, and a customer’s ten-year-old reader fleet knows exactly how much pain a standardized handshake removes.

But I want to spoil the wedding slightly.

“Aliro-certified” is about to become the new “AI-powered” on trade-show banners. People will assume it means “secure.”

Aliro standardizes the handshake. It is deliberately silent on where the access decision actually lives.

If you want real Zero Trust at the door, try this test:

Take your architecture diagram. Draw a red line right through the phone. Assume everything inside that line is fully compromised. The OS is rooted, the app is malicious, and the attacker has a debugger attached (and a decent cup of coffee).

Does the door still stay locked?

If your answer involves the words “well, the wallet’s Secure Element…”, your system trusts the phone.

In a properly designed system, the lock is born with its own private key. The server encrypts a token that only that specific lock can open.

The phone’s only job is to carry those opaque bytes from the server to the lock. It doesn’t read them. It doesn’t check them. It acts as a dumb network component.

Recently, a system I led was certified as a high-security distributed access control system, with the mobile phone officially classified as an “extraneous component.”

In auditor language, that is a beautiful phrase.

It means the phone could be an iPhone, a Pixel, or a potato with an NFC coil — and the security claims would still hold.

Before you bet your corporate campus on a new mobile credential, ask the vendor one question:

What breaks if I root the phone?

If they give you a list, be worried.

If they give you a shrug, you found a lock that treats the phone exactly the way it deserves to be treated.

Like a very expensive, very pretty, completely disposable piece of wire.