The guide
What California actually requires on a dispensary post
Every licensed California retail-cannabis storefront is governed by the same three layers at the same time. The Department of Cannabis Control (DCC) sets the operational rules: visitor sign-in and ID verification, on-site storage of surveillance footage, Metrc seed-to-sale logging, and the post orders that the agency hands the guard at start of shift. Title 16 CCR §5040 lays out the officer-side documentation, including contemporaneous log entries, supervisory sign-off, and the chain of custody on any product movement. The local AHJ — typically the city or county cannabis regulatory office — adds the site-plan deliverables the AHJ inspector walks on an audit pull: a written chain of reporting, photographic documentation cadence, and any local-ordinance-driven armed-posture requirement. A guard post that satisfies only one of the three fails the compliance pull on the other two.
The four regulatory layers a guard post has to satisfy
Concretely, four credentials have to be on file and current for a guard to staff a California dispensary post. Agency license: the security provider itself operates under a current BSIS Private Patrol Operator license (PPO), the only license that lawfully staffs a guard on private property in California. Individual registration: every guard carries a current BSIS guard registration card — the individual credential — and has cleared Live Scan (DOJ and FBI fingerprint-based background) plus a current Power to Arrest training certificate. Firearms permit (when armed): any officer carrying a duty handgun on post additionally carries a current BSIS firearms permit, with the qualification range cadence the bureau requires. License-tier post orders: the operator’s license tier (Type 10 retailer, Type 9 non-storefront, Type 12 distributor, etc.) shapes what post orders need to cover, and the guard on shift runs from the right tier’s orders or the operator’s compliance pull fails.
What “24/7 armed” means in California retail cannabis
Many California municipalities require continuous armed coverage at retail-cannabis storefronts — the local ordinance forces the operator into a 24/7 armed posture, and the post orders have to reflect that posture from open to close. Layered on top are the BSIS firearms-permit overhead and the permit-driven training cadence: an armed officer takes longer to schedule on a new post because the permit paperwork closes before the first shift, and the armed roster is smaller than the unarmed roster, so lead-time planning belongs in the brief. The supervisor on rotation closes the armed posture across the day — a licensed BSIS supervisor who owns the post across multiple shifts, with a real human at dispatch as backup — so that armed coverage never drops during a shift handoff.
Visitor log, ID verification, and the badging standard
DCC §15049 and §15049.1 require contemporaneous visitor sign-in, identity verification, and a badge-in log on every cannabis premise open to the public. Entries are timestamped and made in pen or in a contemporaneous digital log that the guard signs at the moment of sign-in — never backfilled after the visitor has left. The log captures visitor name, ID type and last-four, badge number assigned at sign-in, time in, and time out, plus the purpose of the visit. On an audit pull, the DCC inspector and the local AHJ expect a complete log covering every visitor from open to close; a log with gaps or entries added after the fact is where the audit findings start.
Metrc + CCR §5040 documentation the officer owns on shift
The guard on shift owns the CCR §5040 documentation that survives the auditor’s review: a contemporaneous log entry with the Metrc transfer ID on the same line as any vault access or manifest move, supervisor sign-off on every transfer the officer witnesses, and the seed-to-sale log integration that pairs the camera system timeline with the manifest movement. The officer is not running Metrc directly — Metrc is the operator’s system — but the officer’s log is the contemporaneous record the regulator reads to confirm that what Metrc shows on the screen matches what actually happened on the floor. A regulator pull that finds Metrc entries without a guard-side log entry on the same line is where the compliance finding begins.
What to confirm in writing before the first officer clocks in
Four items belong in writing — and on the agency’s roster file — before the first officer clocks in on a dispensary post. The PPO license: a copy of the BSIS Private Patrol Operator license on file with the operator, current to expiration (Mission Protection Services is PPO #126825). The armed-officer firearms permit: a copy of the BSIS firearms permit on file for every armed officer assigned to the post, with permit number and expiration date. The post-order doc pack: written post orders covering patrol cadence, incident thresholds, escalation chain, supervisor rotation, the visitor-log-and-ID-verification procedures compliant with DCC §15049 / §15049.1, the Metrc-and-CCR-§5040 logging pattern that pairs manifest moves with vault access, and the camera-surveillance footage retention cadence. The audit-ready dashboard export: a guard-side log exportable from a dashboard on regulator request, with the same data on the operator’s compliance team’s view — not a paper log that has to be transcribed after the fact. Ask for proof of all four before the post starts.
A note on this guide
We paraphrase regulatory requirements rather than quote regulatory text, and the specifics below should be confirmed with your AHJ and your compliance counsel before the post orders are finalized. The California cannabis dispensary vertical page walks the full post mix and the regulator pulls the post orders survive, and the cannabis case study documents one engagement’s paid-overlap cadence and supervisor-rotation pattern in practice.