The proportion of wrong people accepted and right people refused - and they trade directly against each other on every biometric reader.

Matching compares a presented sample against a stored template and produces a score. A threshold decides whether that score counts as a match.

Raise the threshold and fewer impostors get in, but more genuine users are turned away. Lower it and the reverse happens.

Published figures are measured under laboratory conditions with cooperative subjects. Real doors with cold hands, hurried users and poor lighting perform worse.

Set the threshold from the consequence of each error. A data centre tolerates rejecting genuine staff; a busy staff entrance at shift change does not.

Whatever the setting, some genuine users will be refused, so an alternative route must exist. Without one, the reader teaches people to prop the door.

Fingerprint for general indoor use, face or iris where hands are dirty or gloved, vein for high security, hand geometry for rugged industrial settings.

Fingerprint readers are the cheapest and most familiar, and they struggle with worn, wet, dry, dirty or damaged fingers - which describes a lot of manual workforces.

Facial recognition is contactless and fast, and is affected by lighting, backlighting and by the angle at which people present themselves.

Iris recognition is highly accurate and requires cooperation and a stable presentation distance.

Vein patterns are internal, which makes them hard to capture covertly and unaffected by surface condition of the skin.

Test the shortlisted modality with the actual user population in the actual conditions. A reader that works for the project team in an office will not necessarily work for a shift changing out of a wet plant.

Either centrally in the access system or on the user's own credential - and storing it on the credential is the safer arrangement wherever it is possible.

Systems store a mathematical template derived from the sample, not an image, and the template is not intended to be reversible into the original.

A central database of templates is convenient and creates a single high-value target. A breach of it cannot be remediated by reissuing anything, because people cannot be issued new fingerprints.

Match-on-card holds the template on the user's smart card, and the comparison happens between the card and the reader. There is no central store at all.

That arrangement is often what makes a biometric deployment acceptable to a data protection authority or a works council.

Whichever is used, encryption at rest and in transit, defined retention, and deletion on departure should be written down before enrolment starts.

Biometric data is treated as a special category in most privacy regimes - it needs a lawful basis, a documented purpose, and frequently a formal assessment before deployment.

The common requirements are proportionality (a biometric is justified by the risk at that door), transparency (people are told what is collected and why), and retention limits.

Several jurisdictions require freely given consent, which in an employment context means a genuine alternative must exist for anyone who declines - and that alternative cannot be punitive.

Some territories have specific biometric statutes with notice and written-release requirements and significant penalties.

Works councils and unions have a formal role in several countries, and consultation before deployment is not optional.

This is genuinely local law. Get an answer for each territory before specifying hardware, because 'we do it this way at head office' is not a defence.

Slower than a card tap - typically a second or more per person, and longer when the first attempt fails.

The read itself takes time, and the user has to present themselves correctly, which adds more.

At a shift change with hundreds of people arriving in a few minutes, that difference compounds into a queue outside the building.

Identification mode, where the reader searches the whole population for a match, is slower than verification mode, where a card or PIN tells the reader which template to check. Verification is much faster on large populations.

The practical answer at high-traffic entrances is a card or mobile credential, with biometrics reserved for the smaller number of high-consequence doors inside.

Model the peak, not the average, and add time for the users the reader will refuse on the first attempt.

Some can, which is why liveness detection is a specification item rather than an assumption.

Presentation attacks use an artefact - a moulded fingerprint, a photograph, a mask - to impersonate a genuine user.

Liveness detection looks for evidence that the sample comes from a living person: blood flow, depth, texture, involuntary movement, or a response to a stimulus.

Modalities differ in inherent difficulty. A photograph defeats naive facial recognition; a vein pattern is much harder to reproduce because it is inside the body.

Ask whether the reader has been tested against presentation attacks by an independent laboratory, rather than accepting a marketing claim.

For the highest-consequence doors, combine the biometric with a credential or PIN. Two factors defeat a spoof of either one.

There must be an alternative - some people cannot enrol at all, and a system with no fallback excludes them.

A measurable proportion of any population cannot register a usable fingerprint because of wear, scarring, skin condition or age. Other modalities have their own exclusions.

Temporary conditions matter too: a bandaged hand, an eye injury, a period of manual work that wears the fingertips.

Accessibility law in most jurisdictions requires that a system does not exclude people with disabilities, and a reader mounted at a fixed height with a fixed presentation angle can do exactly that.

Provide a card or PIN route for these users, enrolled and managed properly rather than improvised at the door.

Where consent is the lawful basis, the alternative must be available to anyone who declines the biometric, without disadvantage.