Investigators need to know whether the night operator was physically inside the water plant when a suspicious workstation logon occurred. What can physical badge logs provide?

Physical access logs are a supporting data source: they help place a person at a facility at a time, which can inform Diamond Model victim and infrastructure vertices. They do not contain command-and-control, session metadata, or proof that a domain credential was used on a host. Authentication and network sources remain required for those questions. Use badge data as context, not as network evidence.