do I need a separate access control vendor