In universities power is typically a bit distributed. Ultimately a nonprofit corporation owns everything, overseen by a board of trustees. But the board doesn't

In universities power is typically a bit distributed. Ultimately a nonprofit corporation owns everything, overseen by a board of trustees. But the board doesn't do that much day-to-day management. Instead there is an administrative and departmental structure. Unlike in a company, it's usually slightly less clearly hierarchical: there is usually a President or Provost, but they usually have less power than a CEO (for example, their ability to hire & fire academic staff is significantly constrained). And there are other structures like departments, faculty senates, etc. which have independent power (varying by university). My guess is that, in this case, nobody at a high level made a decision in the first place, but rather a mid-level organization like MIT security or facilities management instituted the policy. Since they probably are delegated responsibility over building-access systems, they can do that. But the building inhabitants can also try to complain about the way their departments' buildings are being managed. If you were to ask more specifically, "does facilities management or CSAIL own the building?", the answer is sort-of neither, and sort-of both: it's owned by the corporate parent of both of them.