Abstract: A method of operating an access control system comprising a server (3), a control device (4) and a point of sales device (1) for access permissions to a covered area. An algorithm is installed on the point of sales device (1) which can only be executed locally if unlocked by a key transmitted by the server. If a point of sales device is not connected to the server, the algorithm is executed using the key and access permission is generated, encrypted and marked as an offline-generated access permission and encoded. If access control is carried out while the point of sales device is unconnected, the offline-generated access permission is read out by an access control device (4). Based on labelling as an offline-generated access permission, it is identified as such and the validity of the access permission is verified based on the data encoded by the point of sales device.