Is it acceptable to lock the roof access door on the roof side, to prevent access from the roof into the building?
The 2018 edition of the IBC includes a clarification that should be helpful:
1010.1.9.4 (6) Doors serving roofs not intended to be occupied shall be permitted to be locked preventing entry to the building from the roof.
This change to the IBC is intended to apply to roof areas that may contain mechanical equipment or where someone may occasionally need to access the roof – not to occupiable roofs. The IBC includes the following as examples of occupiable roofs: vegetative roofs, roof gardens, or roofs used for assembly or other purposes. If the roof is occupiable, it must be served by code-compliant means of egress which typically includes doors that allow free egress from the roof into the building. If the roof is not considered occupiable, the new paragraph in the 2018 IBC clarifies that the door leading from the roof to the building can be locked on the roof side. In most cases, the door leading to the roof can and should be locked on the interior side, to prevent unauthorized access to the roof.
For more information about roof doors, refer to this Decoded article.