Ok Banshee, I have one for you 
A maglock that is protected by a host can be (and probably should be, from the POV of the security manager) not visible on the matrix to personas that are not also inside that same host. Makes perfect sense for combination or keycard style maglocks, since it cuts down on hacking shenanigans.
What happens when the maglock is opened by a RFID signal (like from an employee ID). That's a wireless interaction, so if the lock is inside the host the ID badge can't transmit the RFID to the host, or can it, even though the maglock can't be "seen" by the ID badge? Related question: Does the host have to simply allow outsider access to that one device for it to work?
If it's a legitimate authorized and company issued RFID then it would reside "inside" the host ... ie it has true User access already
Between the User Persona, personal commlink PAN, the Device Icon for the RFID and the Host there is something eventually not slaved to the Host and not "in" the Host. The User Persona has User Access to the RFID, but is probably not slaved to the Host. That RFID would be controlled, somehow, by the User's personal Commlink. Which is probably not slaved to the Host in many cases. (Some Commlinks are very likely to be slaved to the Host, but that creates its own series of security vulnerabilities).
Somewhere in that chain there is likely a security vulnerability of an Icon of some kind that isn't Slaved to the Host but would have control over the RFID that opens the lock. Spoof Command on the right Commlink would then be the way. Or a good Face and just skip the Hacking altogether. As a GM I'm good with either.
I'm also good with " If maglocks can be seen when the GM wants them to be seen, and they can't be seen when the GM doesn't want them to be seen, " because sometimes "Hack the damn Host you lazy bastage" : )