A Vehicle Followed the Gate In: Observe, Separate Access, and Do Not Confront

By Jared Mastroianni

• October 5, 2026
• 6
• Business Storage, Guides, Self Storage

A safe gate-response plan begins before an incident, with clear observation, escalation and handoff roles. AI-generated editorial image; not documentary evidence.

A practical response for self-storage managers when an unknown vehicle enters behind an authorized customer

The gate opens for one customer. Before it can close, a second vehicle follows through. The driver does not stop at the keypad, and the manager cannot tell whether the person is another customer, a guest, a vendor, a wrong turn or an unauthorized entrant.

That is enough to trigger a controlled response. It is not enough to diagnose intent.

The first job is not to chase the vehicle or demand an explanation in the drive aisle. It is to protect people, keep the exit usable, record the observable entry, separate the known credential from the unknown vehicle and move the decision to the facility’s authorized incident route.

Tailgating turns a simple gate event into two different access states: one authorized entry and one unresolved entry. If those states are combined, the facility can accidentally suspend the wrong customer, preserve the wrong time window or describe an assumption as fact.

Start with distance, not confrontation

If the vehicle is moving unpredictably, a person is threatening someone, a weapon is seen, a collision occurs or another immediate danger exists, move people away and use the emergency route in the site plan. USAGov directs people to call 911 in an emergency and to contact local law enforcement to report theft or property crime. The exact nonemergency route varies by jurisdiction and company policy.

Do not stand in front of the vehicle, close a gate onto it, use another vehicle to block it, follow it between buildings or send a customer to identify the driver. A manager should not turn an access-control exception into a physical confrontation.

If no immediate threat is apparent, stay in a protected location and begin the nonemergency response. Keep staff and customers out of the vehicle’s path. Preserve normal egress. Notify the person designated by the site’s incident procedure.

“No immediate threat observed” is a bounded observation. It does not mean the entrant is authorized or the condition is safe.

Record behavior, not appearance

The useful fact is how the entry occurred: a second vehicle crossed the gate line during the first vehicle’s authorization cycle without a separately observed credential event.

Record only what an employee directly observed or what a system recorded. That may include:

• facility and gate identifier;
• observed entry time and timezone;
• direction of travel;
• vehicle type, color and visible plate characters if safely observable;
• whether the gate was opening, open, closing or obstructed;
• the credential event associated with the first vehicle;
• whether a separate credential event exists for the second vehicle;
• last safely observed location; and
• the names of the incident owner and next reviewer.

Avoid labels such as “criminal,” “thief” or “suspicious person.” DHS’s “If You See Something, Say Something” guidance emphasizes reporting suspicious behavior and situations rather than appearance. Its examples include someone breaking into a restricted area, and it directs emergencies to 911. That public-awareness guidance does not decide whether a particular self-storage entry is a crime. It supports a fair operating rule: describe the action, not a person’s race, age, clothing, accent or other irrelevant characteristic.

If the manager could not safely read a plate, write not observed. Do not enhance a blurry image, guess at a character or ask staff to drive through the property for a better view.

Keep the authorized customer separate

The credential that opened the gate identifies an access event. It does not automatically prove that the credential holder invited the following vehicle or even noticed it.

Preserve the first vehicle’s credential event as one record. Preserve the second vehicle’s observed crossing as another. Link them by time and gate, but do not merge their identities.

Before changing the authorized customer’s access, verify the facility, gate, credential, event time and account relationship. Consider whether the customer reported being followed, whether a guest procedure applies, whether a vendor arrival was expected or whether a sensor produced an incomplete event. Those are review questions, not reasons to erase the unresolved state.

Do not tell the first customer, “You let someone in,” unless evidence and policy support that conclusion. A neutral contact, if authorized, asks for information without accusation: “We are reviewing a second vehicle entry that occurred during your 10:14 a.m. gate cycle. Did you observe another vehicle follow through?”

The customer’s answer is a statement source. It is not a substitute for the gate record or video.

Preserve a narrow evidence window

Access events, intercom calls, camera clips, gate-controller states and employee notes may have different retention periods and clocks. Set a narrow initial window around the observed entry, then let the incident owner expand it if necessary.

For each preserved source, record:

• system or device;
• native event ID or export name;
• facility time and stored timezone;
• export time and person;
• original file location;
• retention deadline; and
• any known gap, clock offset or outage.

CISA’s small-business logging guidance explains that logs record who accessed what, when and from where. It recommends protecting logs from unauthorized access or deletion and assigning incident-response roles. The guidance is written for business-system cybersecurity, not self-storage gate investigations. The useful operating principle is limited: preserve the original record, restrict changes and name the owner before a short retention window removes context.

A screenshot can document what the manager saw. It should not silently replace the provider’s native event or original video. Do not rename camera channels, reset the relevant credential, delete a user, overwrite a note or change controller settings until the incident owner has preserved the needed state or explicitly authorizes the change.

Do not make the gate prove more than it can

A gate event may show that a credential was accepted. A loop or photoeye may show that one or more objects crossed a point. A camera may show vehicles from one angle. None of those records necessarily establishes who was driving, why the second vehicle entered or what happened after it left the frame.

NIST SP 800-53 Rev. 5 includes controls for enforcing physical-access authorizations, maintaining physical-access audit logs and monitoring physical access. It is a federal security and privacy control catalog, not a self-storage requirement or proof that a facility’s gate system meets a standard. Its relevance is structural: authorization, entry control, logging, monitoring and incident response are separate functions.

That separation prevents three common overstatements:

• an accepted credential is not proof that every following vehicle was authorized;
• a camera image is not a complete property search; and
• an employee’s observation is not a final determination of intent.

Use unresolved entry until the authorized reviewer has enough evidence to apply a more specific state.

Change operations only within authority

The incident owner may decide to contact law enforcement, notify customers in a bounded area, preserve additional recordings, change a credential, increase a patrol, place the gate in a different operating mode or temporarily restrict an area. Those decisions depend on the facts, site plan, vendor instructions and local requirements.

The frontline manager should not improvise a lockdown, trap a vehicle inside, disable an emergency exit, publish a vehicle image or send a mass accusation. A rapid response still needs a named owner and an expiration condition.

If the gate or safety device behaved unexpectedly, open a separate equipment issue. Do not bury a gate timing, sensor or closing fault inside the security note. A vehicle that followed another vehicle and a gate that failed its expected cycle can coexist, but they require different owners and closure evidence.

A fictional follow-through event

At 10:14 a.m., an authorized customer enters fictional Harbor Row Storage through the east gate. A gray sport-utility vehicle follows before the gate closes. The manager observes the second crossing from the office window and does not see a separate keypad stop. No threatening action or collision is observed.

The manager keeps staff in the office, confirms the exit remains available and notifies the fictional incident owner. The gate log shows one accepted credential at 10:13:52. A camera clip shows two vehicles crossing, but the second plate is partly obscured. The manager records only the visible characters and marks the rest not observed.

The native gate event, relevant clip and intercom log are preserved with timezone, export owner and retention date. The first customer is not suspended automatically. An authorized reviewer contacts the customer with a neutral question and checks for an expected vendor. The second vehicle leaves at 10:21 a.m. without another observed event. The reviewer keeps the state unresolved and follows the company’s nonemergency reporting route.

Every facility, person, time, vehicle, system, record and action in this example is fictional. It is not a customer incident, crime report, security outcome or statement about modSTORAGE.

Give the next shift one clear handoff

The accompanying Gate Follow-Through Response Card keeps the response compact:

1. protect people and preserve egress;
2. observe from a safe position;
3. separate the authorized event from the unresolved entry;
4. preserve a narrow evidence window;
5. notify the incident owner;
6. avoid confrontation and accusation; and
7. record the next decision, owner and review time.

Review the card before an incident. Confirm who can preserve camera and access records, who can change credentials or gate modes, who contacts law enforcement, and what conditions justify a customer notice. Test whether clocks agree and whether staff know each system’s retention window.

The operating standard is not “identify the driver immediately.” It is: keep distance, record the behavior, preserve the source, separate known access from unknown entry and let the authorized owner decide the next state.