A physical access point with a digital decision behind it
A badge credential proves its holder is authorized to pass a specific physical access point, typically checked by a local reader against a locally cached list rather than a live network round-trip on every single use. This design exists for a practical, physical reason: a building's doors need to keep working even during a brief loss of connectivity to a central system, which pushes the same freshness-versus-availability tradeoff that shows up everywhere else caching does into the physical-security domain specifically.
Revoking a badge quickly matters for exactly the reason revoking any other credential quickly matters, and it depends entirely on how often each individual reader actually syncs its local list against the authoritative source — a badge revoked centrally, but not yet synced to one specific door's reader, still opens that door until the next sync happens.
A correctly functioning system, defeated by ordinary behavior
Tailgating — following an authorized person through a door held open for them, without presenting a credential of one's own — bypasses even a perfectly configured badge system entirely, because the failure isn't in the system at all. The digital check worked exactly as designed; the gap is purely physical and social, since most people hold a door for whoever's right behind them. No amount of hardening the badge-reading technology addresses this, which is why closing it generally requires physical controls or a workplace norm of actually challenging unfamiliar tailgaters, rather than any improvement to the digital access-control system itself.