Master Key Hierarchy Planning 2026: The Levels, What Cross-Keying Really Costs, and How to Leave Room for the Building You Will Have

A master key system is a piece of architecture. It is designed once, before any cylinder is cut, and then the building lives inside that design for as long as the cylinders last.

HYDE (Canton Hyland, Zhongshan, since 1998) makes the 578 SSET and 3431 SSET covered in this article.

Almost every system that becomes unworkable becomes unworkable for one of two reasons, and both are design decisions made in the first week rather than failures that develop later.

The levels, from the top down

A system does not need all five. Most buildings need three at most, and the number of levels should follow the way the organization actually delegates authority, not the way the floor plan is drawn.

That distinction is the first design decision and the one most often got wrong. A two-storey office with one facilities manager does not need a grand master; it needs a master and differs. Adding levels it does not use costs capacity, costs money, and creates keys somebody has to track.

Why every level costs capacity

This is the part that is rarely explained and explains everything else.

A keyway has a finite number of usable differs, distinct bittings that operate one cylinder and no other. That pool is set by the platform: the number of pin positions, the number of depths available at each, and the manufacturer's rules about which combinations are permitted.

Mastering works by giving a cylinder more than one shear point, so that both a change key and a master key operate it. Every additional shear point removes other bittings from the usable pool, because those bittings would now also operate the cylinder by accident.

So the arithmetic is not additive, it is subtractive. Every master level you add, and every door you master into more than one group, shrinks the number of genuinely unique change keys the system can still issue.

That is why a system "runs out", not because somebody used the last number in a list, but because the combinations that remain would conflict with combinations already issued.

Cross-keying is the expensive favor

Cross-keying means a cylinder is operated by keys from more than one branch of the hierarchy, the classic case being a meeting room that the sales master and the marketing master both open.

It is requested as a small convenience and granted the same way, one door at a time. It is neither small nor one-time: each cross-keyed cylinder adds shear points and consumes disproportionately from the pool, and a system with cross-keying sprinkled through it exhausts long before its nominal capacity.

It also weakens key control in a way nobody notices. A cylinder with many shear points can be opened by more keys than intended, including by keys that were never meant to work anywhere near it.

The discipline that prevents this is procedural rather than technical: cross-keying requests go to whoever owns the system, not to the locksmith, and are answered against the design rather than against the request. Most of them are better solved by moving the door into a different group.

The five questions that produce a hierarchy, in order

A system designer will ask these. Having the answers ready turns a three-week exchange into a one-week one.

Who needs to open everything, and how many of them are there? If the answer is more than two or three people, the question is usually wrong, a large number of grand master holders is a system with no top level in practice, because a key that dozens of people carry is a key that cannot be recalled.

What is the smallest group worth mastering? A master key that opens four doors held by one person is usually worse than four change keys on a ring, because it consumes capacity and adds a key that opens more than its holder needs.

Which doors must never be on a master? There are usually a few, a safe room, a pharmacy, a server room, a personnel records office. Saying so at design time is easy; removing a door from a master later means recylindering it and reissuing every key that opened it.

Who gets a key when somebody leaves? That is the recall procedure, and its existence is what makes the rest of the design meaningful. A system with no recall procedure degrades into an open system in about five years, whatever profile it was cut on.

What happens when a master key is lost? This is the question people avoid and the one with the largest number attached. A lost change key costs one cylinder. A lost master costs every cylinder that key operated, and the decision to rekey or accept the risk is much easier if it was discussed before it happened rather than during.

Two common designs, and when each is right

Vertical: the hierarchy follows the building: a master per floor, a grand master over all floors. It suits buildings where access follows geography, a hotel, a hospital wing, a self-storage facility.

Horizontal: the hierarchy follows function: a master for cleaning across every floor, another for maintenance, another for security. It suits buildings where the same role needs the same rooms on every floor, which is most offices.

Most real systems are a hybrid, and the hybrid is where cross-keying pressure comes from, because a cleaner's master and a floor master both want the same cupboard.

The useful move is to decide which axis is primary before drawing anything. A system that is primarily horizontal with a few geographic exceptions is coherent. A system that is both at once, decided door by door, is the system that runs out.

The floor master key, and where it sits

A floor master key opens every door on one floor, or on one defined section of a building, and no door anywhere else. The name describes the group it covers, not a rank. In a single building it is the master (MK) level directly under the grand master (GMK, written グランドマスターキー in Japanese specifications); on a site of several buildings, where each building already has its own master, the floor master sits one level lower, in the sub-master (SMK) position. Either way it is above the change keys and below whoever opens the whole building.

It is worth a level when somebody's responsibility genuinely stops at the floor: a charge nurse on one ward, a hotel housekeeper assigned to one floor, a floor warden, a tenant who leases a whole floor. It is not worth one when nobody's job ends at the stair door; then the floor is a line on the drawing rather than a line of authority, and the level spends capacity for nothing. It also limits the cost of a loss: a lost floor master means rekeying one floor, not the building.

Floors are also where cross-keying pressure shows up first, from two directions. Some doors belong to two floors: a stair door, a plant room, a lecture hall with entrances on both levels. Put those in a group of their own under the building master rather than cross-keying them into two floor masters. Some roles cross every floor: cleaning, maintenance, security. Give that role the building master under a signed sign-out procedure, or make the design horizontal; a separate cleaning master laid across the floor masters cross-keys every door in the building, which is exactly the pattern the cross-keying section above warns against.

A worked example, hypothetical and not based on any real site: a campus of 10 buildings, each with 5 floors of 100 doors, so 5,000 doors in all. The design is vertical, because access follows geography, and it needs 4 levels. A campus is the case a fourth level is for; a single building rarely is.

That is 5,061 distinct bittings, and only 61 of them open more than one door. Those 61 are the keys the register has to track and the recall procedure has to cover, and that is what keeps a 5,000-door system manageable: the change keys, which are nearly the whole total, each put one door at risk. A lost floor master means rekeying 100 cylinders; a lost building master, 500. No grand grand master is needed, because there is one system, not several. In practice a few doors, such as a server room, would stay off every master, and rooms used by the same group can share a change key; both bring the totals down.

The same example should reserve room, as the next section explains: designing the groups for 12 buildings and 8 floors per building leaves 2 buildings and 3 floors per building unissued. Whether a given platform can carry 4 levels, 5,000 change keys and that reserve is the platform's question, answered by whoever designs the system, and that person should be handed this table, not just the door count.

Expansion allowance, designed in or not at all

A system cut to exactly today's building has no room, and buildings change: floors get subdivided, departments merge, a new wing arrives.

Expansion has to be reserved at design time, by deliberately leaving groups and differs unissued. It cannot be added afterwards, because the unissued combinations that would have been the expansion have by then been issued as ordinary differs.

A reasonable starting point is to design the hierarchy around the organization as it will plausibly be in five to ten years, then reserve capacity on top of that. What that means numerically depends on the platform, and it is a question for whoever designs the system, but the decision to reserve, and roughly how much, is the client's and belongs in the specification.

Our specification page puts the keying clause among the four that decide the price, for exactly this reason: it costs nothing to write and cannot be retrofitted.

Construction keying, and the handover that has to happen

During construction, the building is full of people who need access and will not hold keys afterwards. Construction keying solves this with a temporary key that works until the permanent key is first used in each cylinder, which then permanently invalidates the construction key in that cylinder.

Two things go wrong with it, and both are procedural.

Nobody runs the permanent keys through every cylinder at handover. A cylinder that never saw its permanent key still accepts the construction key, and there is no way to tell by looking. The handover has to include somebody physically turning the permanent key in every lock and recording that they did.

The construction keys are not collected: they are worthless once every cylinder has been converted and dangerous until then, which makes the collection worth doing before the conversion rather than after.

What to decide before a single cylinder is cut

How many levels, and what each corresponds to in the organization rather than on the floor plan.

Who owns the system, and who may authorize a cut. This is the control that operates day to day and the one most often left undefined until somebody needs a spare urgently.

What the expansion allowance is, and that it is reserved rather than notional.

Which doors are genuinely cross-keyed, decided now and as few as possible, rather than accumulated later.

Whether the register is a deliverable, in a format you can read without the supplier's software, covered on our key blanks page, where the register is argued to be the real lasting product of the whole exercise.

And the profile and its status, open, restricted or patented, because that decision constrains everything above it and is the hardest of all of them to change later.

What we confirm, and what we do not

We confirm the cylinder range, the lengths and splits, the finishes and the quantities, and we confirm the profile and what is committed on key control, per order and in writing.

On the catalog side, the product pages say which items can join a system: the 578 tubular lock and the 3431 lever set are both published as able to be keyed alike to our deadbolts or master keyed.

The hierarchy design itself is normally done by whoever holds the system (a locksmith, a security consultant, or the manufacturer of a patented platform) because it depends on the platform's own mastering rules and on an organization chart we are not party to. We would rather say that plainly than draw a hierarchy that looks right and conflicts with the platform it has to be cut on.