James did the right thing, but he may or may not have done it in the right way. Your company policy may or may not be good enough and/or clear enough, and he may or may not have known the policy. This is an opportunity to review (with your boss) and improve company processes and/or how they are communicated to new hires. As a benefit, the more you do that the less likely it is James can be considered responsible for doing anything wrong, and the more likely it is that the visitor will be found to have done something that either is against the current policy or that policy needs to change to forbid. As for James, the primary issues of concern seem to be:
- He didn't allow an unknown person the free run of the IT room. This is definitely right.
- He didn't recognise the guy and leap to attention. Entirely reasonable, especially for a new hire, unless the company induction process includes a list of names and faces and a note that it's important to learn them all! However, it seems to be why the guy is annoyed, so dealing with this as the real issue might make the spurious issue (not letting him in) go away too.
The visitor seems to have thought that his face should work as a security pass -- that is, every employee (even new ones) should recognise it and let him in. If that is company policy, then it is sufficiently unusual (and unwise IMO) that it needs to be properly communicated, which hasn't happened here since even you don't know about it. If it is not company policy, then ideally it should be communicated to managers that their face is not an access-all-areas pass, and they shouldn't get grouchy when employees fail to treat it like one.
Should an employee be disciplined for not recognising those further up
the chain of command?
Not unless their boss (you) has told them this is important. Even if the company would prefer him to recognise managers, it would be rather disproportionate to make disciplinary matter of it on the first offence, early in his employment, if he has never been told that it's important.
Should employees be encouraged to learn who is above them, even if they will never directly report to them?
If they have no useful work to be doing, then I suppose so. Recognising your own chain of command, even up to C-level, is probably useful and a good idea as a matter of courtesy to their position. A UK SME (so up to 250 employees) in which you have too many people in your chain of command to recognise them all, needs to sort out its org chart with a weed whacker! In contrast, recognising everyone in the whole organisation who outranks you is often impractical, although it does no harm provided you don't waste a lot of time on it.
For that matter, how should James have acted differently if he had recognised the guy? It's one thing to recognise him, it's another thing to let him into an area that he apparently (due to not knowing a door code) may not be authorised for. Given that each office has its own code, it seems natural to assume that those who don't know the code shouldn't be there, even if you do recognise them.
Regarding that and other security matters, you know more than we do about the details of the event and of your office's general policies, but there are various secondary things that could have gone differently.
- He didn't establish the guy's name. You say he asked the guy his name "again" and that the guy refused to answer. You don't say when he asked the first time, so without those details perhaps James could have been clearer what it was he needed from the guy. The guy should have been willing to give his name (but, as above, it seems what he really wanted was to be recognised wherever he goes, so I suppose that's why he refused). Not that the guy's name is a magic password that should let him into the room, but asking visitors to your office what they claim their name is, is still a good idea.
- He held a conversation with the guy while standing with the door open. This is probably wrong but for a typical office only very marginally so. It led to a situation where the unknown person "tried to get past him", and he blocked him. Presumably with body language rather than physical force, but it's still not an ideal situation to put random IT staff into. One option would be to come out of the room, close the door behind him, and hold the conversation in the corridor, and that would be the preferred option for a seriously-secure room. James could be advised to do that in future, and/or it could be made written policy for the room if appropriate. He could even wait with the guy in the corridor for your return.
- He didn't allow the guy supervised access to the room. Now, if this IT room is a secure server room, that's certainly right. But maybe it's "just" a random office, with no particular security protocols beyond all the other offices in the building, that you sometimes do allow people into for meetings/conversations/etc. If so, then James had the option to let the guy in and sit with him waiting for you. He chose not to take that option, but could be advised to at least consider it in future. One can speculate wildly about the possibility of some burglar overpowering him once in the room, but frankly they could have done that while he was standing in the open doorway. So far as physical security is concerned, that ship sailed when he opened the door at all. Of course, if there are confidential documents visible on desks and so on then it would not be appropriate to allow someone in, even supervised, without establishing their name and authorisation to be there. This is the primary non-aesthetic argument for "clean desk" policies, which you may or may not have.
- He didn't escort him to reception and/or call security. Presumably that would have seriously ground the guy's gears in this case. But if you're in an even lightly-secure area, and decline to identify yourself, then you shouldn't really be surprised if that's what happens from time to time! As a matter of site policy, you should probably tell James (and all employees) what they're supposed to do about possible intruders, and what they're supposed to do to distinguish themselves from intruders.
