Lab, device and prototype access rules for an engineering services team

A client sends two pre-release units of a connected device to your lab on a Friday. By Monday one is missing a battery cover and a visiting contract engineer has photographed the board. Nobody can say who last held the unit. The client's security contact is on the phone and wants a name.

Engineering services teams handle other people's hardware. Access rules are the first line of defence and the first thing a client audits. This guide helps an operations head draft rules that people will follow.

In a product company the prototypes belong to the firm. In a services firm they belong to a client, and the contract may say how they are stored, who may see them and when they return. Robotics and hardware clients are especially watchful, as covered on the robotics companies page. A loose lab is a commercial risk, not just a housekeeping issue.

Not every item needs the same control. A common failure is one heavy rule for everything, which people then bypass. Sort assets into three groups and attach rules to each.

• Open tools and shared test gear: scopes, power supplies, soldering stations. Sign-in at the lab door is enough.
• Internal development boards and company laptops: assigned to a named person, recorded in the asset register.
• Client prototypes, pre-release units and client data media: individually logged, locked when not in use, never taken out without a written release.

Your contract with each client may set its own terms. Read them before you write the tier rules, and let the stricter term win.

1. 1

   Map the spaces

   List each room or cage: main lab, secure bay, storage, charging area. Mark where cameras exist and who holds keys or badges.

2. 2

   Name the owners

   One person owns the lab, one owns the register, and one owns each client programme. Write their names and a backup for each.

3. 3

   Write the entry rule

   Who may enter alone, who needs an escort, and what visitors and contract engineers must sign first. Keep the list short enough to read in two minutes.

4. 4

   Write the movement rule

   Who may carry a device out, to where, for how long, and what record is made. Include home testing and client site visits.

5. 5

   Write the return and loss rule

   Return checks on a fixed form, what to do when a unit is missing, and who tells the client and when.

6. 6

   Brief and sign

   Walk every engineer through the rules in a short session. Keep a signed acknowledgement with the date.

Each client prototype gets a line in a log from the day it arrives. The log answers the questions a client will ask: who had it, where, for what purpose, and in what condition it returned. A shared spreadsheet works if only the lab owner can edit past rows.

Client and programme name.
Unit identifier and condition on arrival.
Date and time received, and by whom.
Storage location.
Each movement: person, purpose, out time, back time.
Photos or data taken (yes or no, and where stored).
Condition at return and signature.
Final return or disposal instruction from the client.

Your lab may host people who are not employees: a consultant for a short specialist task, a client's own engineer, a vendor's field applications person. Their access should be written, scoped and time-bound. State which rooms and devices they may touch, whether they may bring personal phones or cameras, and who escorts them. Describe the scope, access and exit in writing before the first visit. Do not rely on a verbal word at the gate.

Photography is where most leaks begin, usually by accident. Decide whether phones are allowed inside the secure bay. If they are, say what may be photographed. Many firms ban cameras in the client prototype area and allow them elsewhere. Whatever you choose, say it in one sentence on the door and in the policy.

Rules fail at the door, not on paper. The person who watches the lab on a busy evening needs to know what to ask a visitor, when to refuse and whom to call. Give lab owners a one-page guide. Include what counts as a client unit, what to do when a badge is lost and how to record a late entry. Repeat the briefing when a new client programme starts, since each client brings its own terms.

Review the rules every quarter with the lab owner and one engineer who uses the lab daily. Ask which rule is skipped most often and why. If a rule is skipped because it is slow, redesign it. If it is skipped because nobody cares, the problem is leadership attention and not drafting.

Write the first hour in advance. The lab owner checks the log and the last movement, searches the likely rooms, informs the programme head, and records the facts without blame. The programme head then decides when and how the client is told, following the contract. Review the incident afterwards and fix the rule that failed.

The same logic carries over to company laptops and loaned devices. Our asset and laptop usage policy service can help you draft a version that matches your tiers. For engineers who move between programmes, the post on rotation and handover explains how to pass lab knowledge across without passing access automatically.