A scheduled roof-repair visit should not require a permanent door code, a household Apple ID, or the main alarm PIN. Keep a responsible adult present when practical. If a verified roofer needs independent entry, issue one named, short-lived smart-lock code and remove it before the job closes.
This checklist covers a scheduled roof inspection, leak repair, flashing or gutter repair, partial replacement, full replacement, skylight work, or approved attic check. It covers access, alarms, cameras, ladders, roof and attic routes, weather, occupants, pets, failures, and closeout. It does not replace the work order, structural assessment, fall-protection plan, electrical-clearance rule, lease, building rule, insurer requirement, manufacturer instruction, or local law. Stop when the contractor, scope, access route, weather limit, or emergency contact is unclear.
Start with the no-code default
If the resident, owner, or property manager will be present, meet the roofing lead at the agreed entrance, verify the work order, disarm only the required area, and supervise the route. The crew normally does not need a lock credential, Apple Home membership, alarm user, camera account, Wi-Fi password, or smart-home administrator role.
Independent entry may be reasonable for a verified roofing lead during a narrow appointment window. Record why it is needed, who approved it, which door or gate it opens, when it starts, when it expires, and who will remove it. If those answers are missing, use supervised entry.
Build one roof-repair access sheet
Give the resident, property manager, and roofing lead one current sheet. Keep permanent codes, alarm PINs, Wi-Fi passwords, master-key locations, and unrelated household information off it.
- Property address, unit, service entrance, parking or loading rule, and allowed route.
- Resident or owner contact and a second emergency contact.
- Company, booking number, roofing lead, expected vehicles, crew size, and arrival window.
- Roof faces, leak areas, flashing, gutters, skylights, attic inspection points, and excluded spaces.
- Ladder, scaffold, lift, rope-access, material-delivery, debris, power, and weather plans approved in the work order.
- Occupants, pets, children, fragile items, landscaping, solar equipment, and other declared constraints.
- Doors, gates, roof hatches, and alarm zones that may be opened, who watches them, and when they must be secured.
- Who controls the alarm, cameras, HVAC, attic fans, garage door, and smart locks.
- Temporary-code label, start, expiry, removal owner, and tested fallback entry.
Verify the company, roofing lead, and job scope
Match the company, booking reference, arrival window, roofing lead, expected vehicles, crew size, and work scope against the confirmation already held. Use a known company number when a crew member, subcontractor, vehicle, timing, method, or scope changes. A uniform, logo, text message, or caller ID alone is not enough.
Ask the roofing lead to identify every subcontractor before access. Confirm any licence, insurance, permit, or building approval required for the work and location through the appropriate process. A code assigned to “roofers” creates a weak audit trail. A code assigned to the verified lead and exact visit window shows who was responsible.
Map the route before the crew enters
Walk from the service vehicles to every approved work point. Check the building entrance, lift, stairwell, unit door, side gate, driveway, garden, garage, ladder position, scaffold, lift zone, roof hatch, attic route, skylight, material staging area, and debris path that apply. Remove trip hazards without blocking a latch, closer, smoke door, emergency exit, alarm sensor, camera, electrical panel, or fire access.
- Use one working entrance where practical.
- Lock offices, document storage, medicines, valuables, and rooms outside the job.
- Move keys, fobs, remotes, spare phones, and alarm notes away from the route.
- Photograph fragile finishes, landscaping, solar equipment, cameras, and sensors near the work zone when lawful.
- Do not wedge a common security or fire door without written authority.
- Keep ladders, materials, scaffolds, lifts, and debris clear of cameras, sensors, power lines, gates, traffic, and emergency paths.
- Assign one person to every open exterior door, gate, garage, roof hatch, or attic entry when children or pets are present.
Separate roofing authority from security authority
The crew may need access to approved roof faces, gutters, flashing, skylights, attic points, garage areas, hose points, or power. That does not grant permission to change Apple Home residents, add a lock user, reset a camera, browse event history, receive a Wi-Fi password, disable an unrelated alarm zone, operate solar equipment, or enter a private room outside the job.
Record who may move a camera or sensor, open a roof hatch, enter the attic, place a ladder or scaffold, isolate power, or use a driveway or garage. Photograph the approved position of a security device before moving it when lawful. Restore it at closeout and repeat its functional test. Never cover, wet, strike, unplug, drill near, or relocate a security device without approval and the exact equipment instructions.
Control ladders, roof and attic access, weather, and debris
Use the roofing company’s written work method for ladders, scaffolds, lifts, fall protection, electrical clearance, weather, material staging, and debris. A home-security app does not approve work at height, roof loading, structural access, or work near power lines. Confirm who controls the garage, attic hatch, internal ceiling access, skylights, driveway, garden, and waste path.
List every opening that may remain unlocked and who is responsible for it. A roof hatch, attic door, garage, gate, or exterior door left open can defeat an alarm zone, create an entry route, expose a child or pet, admit weather, or leave the property unsecured. Stop when wind, rain, lightning, heat, visibility, structural condition, or electrical clearance exceeds the company’s approved limit.
Create a named temporary code only when needed
Use a code unique to this visit. Do not derive it from the address, unit, phone number, appointment date, or an existing household code. Label it with the company, roofing lead, and date. Set the shortest supported start and end times.
- Confirm the exact person who will receive the code.
- Create a new user rather than sharing an owner, child, cleaner, guest, or maintenance credential.
- Limit the schedule to the verified arrival and closeout window.
- Send it through the agreed channel to the named lead only.
- Ask the lead not to forward it; the lead admits any verified second crew member.
- Test the code once with the responsible resident present.
- Record the label and expiry, but not the digits, on the service sheet.
Use the smart-lock access-code audit for a wider credential review. If the lock cannot label or schedule codes, create the code immediately before entry and delete it at closeout.
Keep the alarm PIN and lock code separate
A lock code opens one door. An alarm user may expose the whole property, user list, history, emergency contacts, and response settings. The resident should normally disarm the required area before work and re-arm it after closeout.
If independent alarm access cannot be avoided and the exact system supports a limited named user, make it separate from the door code and remove both together. Do not place an alarm PIN on a clipboard, roof plan, delivery note, vehicle note, keypad cover, or general work order.
Choose the door and gate state deliberately
Repeated entry may slow a perimeter inspection, but a door or gate held open creates an unlogged access period and a pet-escape risk. Decide the state before work starts.
- Resident-controlled open period: the resident unlocks the entrance, stays responsible for it, and relocks it during breaks.
- Closed between trips: the verified lead uses the temporary code for each entry and confirms the door latched.
- Building-controlled access: concierge or management controls common doors, lifts, roof access, and plant rooms.
Check auto-lock and gate automation before the visit. A deadbolt extending against an open door can damage hardware. A gate closing on equipment, a person, or a pet creates a different risk. If a normal setting is paused, name the person and time responsible for restoring it.
Set camera privacy before the visit
Cameras may confirm arrival and service-route activity, but indoor recording can capture crew members, conversations, labels, documents, children, or private rooms. Follow local notice and consent rules. Aim cameras only at lawful security zones and do not use an appointment as a reason to add hidden recording.
Review the security-camera privacy guide and HomeKit camera privacy-zone guide. Confirm timestamps, event recording, retention, access roles, and lawful export. A live thumbnail does not prove an event was recorded.
Plan for lock, phone, network, and power failure
At least one day before the visit, test the physical key, emergency-power method, battery state, app sign-in, Bluetooth or network path, and offline behavior. The fallback belongs to the responsible resident or manager, not the whole service crew.
- Run the battery and lockout-prevention checklist.
- Test the documented smart-lock emergency-power method.
- Record offline behavior in the internet-outage test log.
- Keep a verified property manager or locksmith contact for a physical failure.
Do not leave an emergency key under a mat, inside an unlocked meter box, near a service entrance, or with an unverified crew member.
Use this roof-repair visit runbook
Thirty minutes before arrival
- Confirm company, roofing lead, vehicles, crew size, booking, scope, and arrival message.
- Check weather, approved height-access method, electrical clearance, material and debris routes, and stop rules.
- Check lock battery, physical key, app sign-in, normal lock action, alarm state, and camera state.
- Secure excluded rooms, keys, documents, medicines, fragile items, pets, and valuables.
- Create and test the named temporary code only if the written plan calls for one.
At arrival
- Meet the roofing lead before admitting the crew.
- Confirm identity, scope, roof faces, attic points, ladders, scaffolds or lift, materials, debris path, power needs, and finish time.
- Walk the allowed route, excluded spaces, roof and attic boundaries, alarm zones, camera notice, pet controls, and emergency exit.
- Test the temporary code with the lead only when independent entry is part of the plan.
During the visit
- Keep one person accountable for every open entrance, gate, garage, roof hatch, and attic access point.
- Relock during breaks, supply runs, vehicle changes, weather delays, and unattended periods.
- Stop an unconfirmed crew member, subcontractor, method, roof face, room, or scope change.
- Record significant access, fall, spill, debris, water, structural, electrical, lock, alarm, camera, pet, or entry event in the incident timeline worksheet.
- Do not extend access for the rest of the day without a confirmed finish time and updated work plan.
Close access before the roofing lead leaves
- Walk the route and check every exterior, common, internal, garage, roof-hatch, attic, and excluded door used.
- Confirm every opening is closed and latched; ladders, scaffolds, lifts, materials, tools, fasteners, debris, protective sheets, and waste are removed or secured as agreed.
- Confirm the lead holds no physical key, fob, remote, alarm PIN, Wi-Fi password, or household account.
- Delete the roof-repair lock code and any temporary alarm user.
- Try the deleted code at the door and confirm it fails.
- Restore auto-lock, garage, gate, alarm, notification, camera, privacy, HVAC, attic-fan, and lighting settings controlled by the owner.
- Test each moved or exposed sensor and camera, then confirm its original security job still works.
- Save the work report, photos, warranty information, permit or inspection record, follow-up date, and emergency contact.
Use the temporary-code removal checklist as a separate closeout record.
Run a 60-minute access test before the visit
- Create a test code with the same schedule type planned for the roofer.
- Confirm it fails before the window, works during it, and fails after expiry.
- Test lock, unlock, auto-lock, door-ajar alert, and the physical key.
- Test the documented emergency-power route.
- Disconnect the internet and record which local functions remain.
- Confirm who receives entry, failed-code, tamper, low-battery, and door-left-open alerts.
- Remove the test code and verify at the keypad that it no longer works.
- Restore normal settings and save the result with the appointment sheet.
Do not start until these blockers are cleared
- The company, booking, roofing lead, required licence, insurance, permit, vehicle, subcontractor, method, or scope cannot be verified.
- The ladder, scaffold, lift, fall-protection, electrical-clearance, weather, material, debris, roof, attic, or pet-control plan is unclear.
- No responsible person is assigned to an open door or gate.
- The only available credential is a permanent household or master code.
- The lock battery, physical key, emergency power, app, or offline path has not been tested.
- A lease, building, fire-door, roof-access, permit, insurer, electrical-clearance, or local rule is unresolved.
- The plan requires giving the whole crew the main alarm PIN or household account.
- Camera notice, consent, privacy, or retention requirements are unclear.
- No one is assigned to delete credentials, restore devices, and verify failure at closeout.
HomeKit security roof-repair visit FAQ
Should a roofer receive my normal door code?
No. Use supervised entry or a named, short-lived code for the verified roofing lead when independent access is necessary.
Should the crew receive my alarm PIN?
Usually not. The resident should control arming and disarming. If a limited named alarm user is unavoidable, keep it separate and remove it with the lock code.
Should I bypass attic, garage, or roof-hatch sensors all day?
No. Limit bypasses to the exact work zone and approved time, keep a responsible person assigned, then close and test every opening before restoring the alarm.
What if weather delays the job?
Confirm the delay and safe stop through a known company channel. Extend a temporary credential only after the new finish time and access need are agreed.
When should the temporary code be deleted?
Delete it during closeout before the roofing lead departs, then test it at the door and confirm it fails.
