The locking requirements for roof doors are a bit of a gray area, due to the varied preferences of local code officials. In most cases, the roof door can be locked on the interior side, preventing access to the roof. It is very rare (except in movies) that the egress plan for the building includes going to the roof for helicopter access. If the roof was part of the egress path, the roof would have to be maintained as an egress route, snow removed, etc.
Here’s what the codes say about roof doors:
NFPA 101 – 2006, 2009:
220.127.116.11.8 If a stair enclosure allows access to the roof of the building, the door to the roof either shall be kept locked or shall allow re-entry from the roof.
IBC – 2003, 2006: 1018.1; IBC – 2009: 1021.1
… For the purposes of this chapter, occupied roofs shall be provided with exits as required for stories. The required number of exits from any story, basement or individual space shall be maintained until arrival at grade or the public way.
NFPA 101 seems to state that if the roof door is locked on the stair side, you don’t have to provide egress from the roof. The IBC requires free egress from the roof if it is occupied, but doesn’t mention egress from roofs that contain only mechanical equipment.
I always take the cautious approach since I have had code officials prohibit the locking of roof doors on the roof side. My first choice would be to lock the door on the stair side, with free egress on the roof side. Security can be provided with the use of an alarm for unauthorized entry from the roof. In cases where the building owner requires more security, I have occasionally used a double-cylinder deadbolt but have instructed the architect/owner to request approval from the code official. Because the deadbolt won’t automatically latch, and because it can only be locked with the use of a key, it is very unlikely that someone will accidentally become locked on the roof.