Permits to work

A permit to work records that a hazardous job has been assessed, controlled and authorized before anyone starts. TruStar Connect handles the whole cycle: a receiver requests it, an issuer reviews it, named authorities sign it in turn, and it is closed out when the work is done.

One permit, not eleven types

There is a single Work Permit. You tick the categories that apply and the permit opens the sections those categories need. A job that is hot work inside a confined space at height is one permit with three sections rather than three separate permits, which is how the paper permits on most industrial sites already work.

• Hot Work opens fire watch, combustible controls and gas testing.
• Confined Space Entry opens space classification, isolation and purging, the atmospheric test record, the entry log and a rescue plan.
• Energy Isolation opens lockout, zero energy verification, try and test, and isolation points.
• Excavation opens locates and their expiry, soil type, cave-in protection and spoil setback.
• The other critical categories, high risk electrical, work at heights, pressurized systems, breaking containment, critical lift, over-the-side, exposed locations, spark potential, abrasive blasting, diving and radiography, each open their own section.

Who can do what

Two separate permissions, because they are two different competencies. Granting both to everyone is how a site ends up with permits nobody independently reviewed.

1. 1
   Permit receiver

   Can raise a permit request and be named as the permit holder for the work. They are accountable for the work being done to the permit. Turn this on per person under Users, in the Permits section of their card. Owners and admins do not need it granted.

2. 2
   Permit issuer

   Can review a request, sign as issuer, and add signatories to the chain. Turn this on per person the same way. Owners and admins always have it.

3. 3
   Subcontractor workers

   Granted the same receiver permission from the subcontractor record. Open the subcontractor, find the worker, and tap Make permit receiver. They can only raise permits for the projects their company is assigned to, which is checked when the permit is submitted rather than only in the picker.

The authorization flow

Set under Organization Settings, in the Permit authorization section. Choose which of the seven signature roles apply and put them in the order they should sign: Permit Issuer, Area Authority, Area Operator, Isolation Authority, Area Interface Authority, Safety Advisor, and Permit Holder. Each role carries the wording of what that person is attesting to.

• Name who normally signs each step, or leave it open and choose when the permit is raised.
• Limit a step to certain work types, so a Safety Advisor signature can apply only to critical lifts.
• Override the whole flow per project, since the area authority and isolation authority differ site to site. A project override replaces the organization default rather than adding to it.
• Set a default permit issuer for the organization, and a different one per project if needed.

How a permit moves

1. 1
   The receiver raises the request

   They tick the work categories, choose the project, describe the task, work through the hazard assessment, and complete the sections their categories opened. The project decides who issues and authorizes it, so it is required.

2. 2
   They say when they plan to work

   The planned start date and time, how many hours the crew works each day, and when the whole scope is expected to be complete. They do not set how long the permit is valid for, because that is the issuer’s judgement rather than a scheduling detail.

3. 3
   The issuer sets the window

   Before signing, the issuer decides how long the permit is good for. A normal permit covers one shift, usually twelve hours from the planned start. A blanket permit runs to a chosen end date. Any subcontractor compliance problem on the project is shown here, so the issuer can decide whether to send the request back over it.

4. 4
   The issuer reviews and signs

   They can sign it, add extra signatories anywhere in the chain, or send it back with comments.

5. 5
   Each authority signs in turn

   Signatures are collected strictly in order and signing out of turn is refused, because a later authority approving work an earlier one has not accepted is exactly what this prevents. Everyone in the chain is visible from the moment the permit is submitted, so a crew planning a shift knows how many signatures still stand between them and starting.

6. 6
   Anyone can send it back

   A rejection requires a reason. It goes to the receiver by email and appears on the permit. Work cannot proceed while a permit is in this state.

7. 7
   The receiver fixes it and resubmits

   Every signature is then collected again from the start. A signature attests to a specific document, and the document has changed, so carrying one forward would put somebody’s name on a permit they never read. The earlier version is kept as revision history, showing who sent it back, when, and exactly what they said.

8. 8
   It goes active

   The moment the last signature lands the permit becomes active and everyone who signed it is emailed a link to the finished document. A signatory who signed at step two otherwise has no way of knowing whether the permit completed or fell over later in the chain.

9. 9
   Close it out

   When the work is done, record that personnel are accounted for, the site is left safe and tidy, isolations are removed, and the area authority has been notified. Close-out belongs to the end of the job, so it is not part of the request.

Drafts

Going back to change the work categories rebuilds the form, so anything already filled in is saved as a draft first. Drafts appear at the top of the permit list for the project, and can be picked up later or deleted.

Only a draft can be deleted, and deleting one asks you to confirm. A permit that has been submitted has been seen by an issuer and may carry signatures, so it stays on the record rather than disappearing.

What the receiver fills in

A request only shows the sections the receiver can honestly answer. Close-out is not there, and neither are the verification questions that belong to the authority who verifies them. Asking a receiver to confirm that zero energy was demonstrated to them, before anyone has isolated anything, only invites a tick in a box that means nothing.

So the receiver states what will be isolated and the isolation authority confirms it was. The receiver says which gas tests are required and the gas tester records the readings. Simultaneous and interacting work is left to the issuer, because somebody working on one job cannot know what else is permitted in the area. The form each person sees is the part they are accountable for.

Blanket permits

For repeating work over several days rather than a single shift, tick Request a blanket permit. It sits in Work Details under the date the work scope is due to be complete, which is where the question naturally arises. The receiver asks for one; the issuer decides how many days to approve, because that is an authorization decision rather than a request.

• The issuer sets the end date the permit runs to.
• They can set a time each day at which the permit suspends itself, usually the end of shift. This happens automatically at that time in your organization’s time zone.
• A suspended permit cannot be worked under until it is revalidated.
• The issuer chooses who has to revalidate: the issuer alone on routine work, or some or all of the original signatories where conditions change between shifts.
• Revalidating means confirming nothing has changed since the permit was authorized. If something has changed, the work needs a fresh request rather than a revalidation.
• Each revalidation is recorded with who signed and when, so the permit shows every day it was brought back and by whom.

Signatories outside your organization

A client area authority or a third party inspector can be added to the chain by email. They receive a link that opens the permit directly and lets them sign or send it back, with no account and no password. Their name, company, job title and the exact time are recorded with the signature and printed on the permit.

Finding a permit

The Permits page groups everything by project, because that is how a site thinks. Within each project, permits are grouped by what needs doing: waiting for approval, active, and suspended. A permit waiting for a signature names who it is waiting on, so a supervisor knows who to go and find rather than just that it is somewhere in approval.

Closed and expired permits move to a separate Archive rather than sitting at the bottom of the list, so a year of finished work does not bury the handful that matter today. The search box covers permit number, project, client, requester, issuer, work type and date at once.

While the permit is live

An issued permit carries a QR code. Scanning it opens the permit for anyone on site to read, without needing an account, so a crew can check what they are working under and an auditor can verify it on the spot.

Gas readings and confined space entries are logged against the permit as the work runs.

• Readings are checked against the limits as they are typed, using the Class 1 or Class 2 limits for the space where one is set. An out of range reading is flagged immediately rather than noticed later by somebody reviewing the log.
• An out of range reading is still recorded. The log has to show what the detector actually said, and a reading outside the limits is exactly the record that matters afterwards.
• If a retest frequency was set on the permit, the app says how overdue the next test is rather than leaving the frequency as a number on a form nobody tracks.
• The entry log shows who is inside the space right now, with a running count against the occupancy limit. Somebody already logged in cannot be logged in twice, and the space cannot be filled beyond its limit.
• Logging somebody out always works, even on a suspended or expired permit. A person physically leaving a space must always be recordable whatever state the paperwork is in.
• Nothing can be logged against a permit that is suspended or not yet fully signed, because that would record work that should not be happening.