From approvals to audit: Operationalizing visitor security