Master Key Hierarchy Planning 2026: The Levels, What Cross-Keying Really Costs, and How to Leave Room for the Building You Will Have

A master key system is a piece of architecture. It is designed once, before any cylinder is cut, and then the building lives inside that design for as long as the cylinders last.

Almost every system that becomes unworkable becomes unworkable for one of two reasons, and both are design decisions made in the first week rather than failures that develop later.

The levels, from the top down

A system does not need all five. Most buildings need three at most, and the number of levels should follow the way the organisation actually delegates authority — not the way the floor plan is drawn.

That distinction is the first design decision and the one most often got wrong. A two-storey office with one facilities manager does not need a grand master; it needs a master and differs. Adding levels it does not use costs capacity, costs money, and creates keys somebody has to track.

Why every level costs capacity

This is the part that is rarely explained and explains everything else.

A keyway has a finite number of usable differs — distinct bittings that operate one cylinder and no other. That pool is set by the platform: the number of pin positions, the number of depths available at each, and the manufacturer's rules about which combinations are permitted.

Mastering works by giving a cylinder more than one shear point, so that both a change key and a master key operate it. Every additional shear point **removes other bittings from the usable pool**, because those bittings would now also operate the cylinder by accident.

So the arithmetic is not additive, it is subtractive. Every master level you add, and every door you master into more than one group, shrinks the number of genuinely unique change keys the system can still issue.

That is why a system "runs out" — not because somebody used the last number in a list, but because the combinations that remain would conflict with combinations already issued.

Cross-keying is the expensive favour

Cross-keying means a cylinder is operated by keys from more than one branch of the hierarchy — the classic case being a meeting room that the sales master and the marketing master both open.

It is requested as a small convenience and granted the same way, one door at a time. It is neither small nor one-time: each cross-keyed cylinder adds shear points and consumes disproportionately from the pool, and a system with cross-keying sprinkled through it exhausts long before its nominal capacity.

It also weakens key control in a way nobody notices. A cylinder with many shear points can be opened by more keys than intended, including by keys that were never meant to work anywhere near it.

The discipline that prevents this is procedural rather than technical: **cross-keying requests go to whoever owns the system, not to the locksmith**, and are answered against the design rather than against the request. Most of them are better solved by moving the door into a different group.

The five questions that produce a hierarchy, in order

A system designer will ask these. Having the answers ready turns a three-week exchange into a one-week one.

**Who needs to open everything, and how many of them are there?** If the answer is more than two or three people, the question is usually wrong — a large number of grand master holders is a system with no top level in practice, because a key that dozens of people carry is a key that cannot be recalled.

**What is the smallest group worth mastering?** A master key that opens four doors held by one person is usually worse than four change keys on a ring, because it consumes capacity and adds a key that opens more than its holder needs.

**Which doors must never be on a master?** There are usually a few — a safe room, a pharmacy, a server room, a personnel records office. Saying so at design time is easy; removing a door from a master later means recylindering it and reissuing every key that opened it.

**Who gets a key when somebody leaves?** That is the recall procedure, and its existence is what makes the rest of the design meaningful. A system with no recall procedure degrades into an open system in about five years, whatever profile it was cut on.

**What happens when a master key is lost?** This is the question people avoid and the one with the largest number attached. A lost change key costs one cylinder. A lost master costs every cylinder that key operated — and the decision to rekey or accept the risk is much easier if it was discussed before it happened rather than during.

Two common designs, and when each is right

**Vertical.** The hierarchy follows the building: a master per floor, a grand master over all floors. It suits buildings where access follows geography — a hotel, a hospital wing, a self-storage facility.

**Horizontal.** The hierarchy follows function: a master for cleaning across every floor, another for maintenance, another for security. It suits buildings where the same role needs the same rooms on every floor, which is most offices.

Most real systems are a hybrid, and the hybrid is where cross-keying pressure comes from — because a cleaner's master and a floor master both want the same cupboard.

The useful move is to decide which axis is primary before drawing anything. A system that is primarily horizontal with a few geographic exceptions is coherent. A system that is both at once, decided door by door, is the system that runs out.

Expansion allowance, designed in or not at all

A system cut to exactly today's building has no room, and buildings change: floors get subdivided, departments merge, a new wing arrives.

Expansion has to be reserved at design time, by deliberately leaving groups and differs unissued. It cannot be added afterwards, because the unissued combinations that would have been the expansion have by then been issued as ordinary differs.

A reasonable starting point is to design the hierarchy around the organisation as it will plausibly be in five to ten years, then reserve capacity on top of that. What that means numerically depends on the platform, and it is a question for whoever designs the system — but the decision to reserve, and roughly how much, is the client's and belongs in the specification.

Our specification page puts the keying clause among the four that decide the price, for exactly this reason: it costs nothing to write and cannot be retrofitted.

Construction keying, and the handover that has to happen

During construction, the building is full of people who need access and will not hold keys afterwards. Construction keying solves this with a temporary key that works until the permanent key is first used in each cylinder, which then permanently invalidates the construction key in that cylinder.

Two things go wrong with it, and both are procedural.

**Nobody runs the permanent keys through every cylinder at handover.** A cylinder that never saw its permanent key still accepts the construction key, and there is no way to tell by looking. The handover has to include somebody physically turning the permanent key in every lock and recording that they did.

**The construction keys are not collected.** They are worthless once every cylinder has been converted and dangerous until then, which makes the collection worth doing before the conversion rather than after.

What to decide before a single cylinder is cut

How many levels, and what each corresponds to in the organisation rather than on the floor plan.

Who owns the system, and who may authorise a cut. This is the control that operates day to day and the one most often left undefined until somebody needs a spare urgently.

What the expansion allowance is, and that it is reserved rather than notional.

Which doors are genuinely cross-keyed, decided now and as few as possible, rather than accumulated later.

Whether the register is a deliverable, in a format you can read without the supplier's software — covered on our key blanks page, where the register is argued to be the real lasting product of the whole exercise.

And the profile and its status, open, restricted or patented, because that decision constrains everything above it and is the hardest of all of them to change later.

What we confirm, and what we do not

We confirm the cylinder range, the lengths and splits, the finishes and the quantities, and we confirm the profile and what is committed on key control, per order and in writing.

The hierarchy design itself is normally done by whoever holds the system — a locksmith, a security consultant, or the manufacturer of a patented platform — because it depends on the platform's own mastering rules and on an organisation chart we are not party to. We would rather say that plainly than draw a hierarchy that looks right and conflicts with the platform it has to be cut on.