Permit-to-Work Explained: 4 Decision States Supervisors Must Separate

A crew is ready to enter a confined space, but the permit has already been signed. The gas test is older than the shift, the rescue roster has changed, and the supervisor is unsure whether the original authorization still applies. The form is complete, yet the decision is not.

That situation explains why a permit-to-work should be read as a set of decision states rather than a single approval event. The document supports control, but the work remains authorized only while the stated conditions, people, equipment, and boundaries are still true.

A permit-to-work is a formal authorization that defines the conditions under which a high-risk task may begin, continue, pause, or close. It identifies the exposure, required controls, responsible roles, and stop conditions, while field verification determines whether the authorization still matches the work being performed.

What does a permit-to-work control?

A permit-to-work controls the transition from planned work to authorized work. It brings the hazard, the required barriers, the responsible people, and the operating limits into one decision record. ISO 45001:2018 supports this logic through operational planning and control, although the standard does not make a signed form sufficient evidence that the task is controlled.

The permit is strongest when it makes a difficult decision visible. The supervisor should be able to point to the isolation, exclusion zone, atmospheric test, rescue arrangement, or energy-control verification that allows the work to proceed. If the document lists a control that nobody can verify, it records intention without proving protection.

What are the four permit-to-work decision states?

1. Prepare

Preparation is the state in which the task is being made ready for authorization. The team identifies the work scope, energy sources, interfaces, required controls, and people who hold each decision. A permit can be drafted during this state, but drafting is not approval.

The key question is whether the planned controls can be installed and checked before exposure begins. If the answer depends on an assumption about equipment condition, weather, staffing, or another work group, that assumption belongs in the review rather than being hidden in a signature.

2. Authorize

Authorization means the stated conditions have been checked and the task may begin within the defined boundary. The authorizing role should confirm that the people performing the work understand the hazards, the controls are available, and the stop conditions are clear.

Authorization is not a transfer of responsibility from the supervisor to the form. James Reason's work on latent failures is useful here because it reminds leaders that a front-line error can be shaped by weak planning, unclear interfaces, or controls that were never made available.

3. Suspend

Suspension is the state in which work pauses because the original conditions no longer support continuation. A change in scope, failed test, loss of communication, weather deterioration, equipment alarm, or shift handover can move a task into suspension even when no incident has occurred.

Suspension should be treated as a decision, not as an informal break. The team needs to protect the area, account for people, identify what changed, and establish whether the existing permit can be revalidated or must be replaced. A permit that remains open while the work has materially changed creates false continuity.

4. Close out

Closeout confirms that the task ended, temporary controls were removed or transferred correctly, the area was left in a known condition, and outstanding actions were assigned. It also separates completion of the work from restoration of normal operation, which may require a different verification.

A closeout signature should therefore answer more than whether the crew finished. It should show whether isolations were removed under control, guards were restored, residual hazards were communicated, and the next owner accepted the condition.

How can supervisors distinguish the states in practice?

This distinction matters because many permit failures are really state failures. A preparation document is treated as an authorization, an authorization is treated as permanent, or a suspended task is treated as complete because the crew left the area.

When should a permit be revalidated?

Revalidation is needed whenever a condition that supports the original decision changes. Supervisors should review the permit after a shift change, a change in crew, an interruption that alters the work sequence, a new nearby activity, a weather change, an equipment fault, or any modification to the isolation or rescue arrangement.

The point is not to create paperwork for every ordinary movement. It is to test whether the authorization still describes the task that people are actually about to perform. In more than 250 cultural transformation projects supported by Andreza Araujo, the recurring leadership lesson is that credibility depends on what happens after conditions change, not only on what was signed before work began.

What mistakes make permits look stronger than they are?

One mistake is treating the permit as a checklist that can be completed away from the work. Another is allowing one signature to represent several roles whose responsibilities are different. A third is leaving stop conditions vague, so the crew knows that work can be paused but not who has authority to make the next decision.

Andreza Araujo describes the difference between documented compliance and operational control in The Illusion of Compliance. A permit belongs to the second category only when its requirements are visible in the work area and the person who finds a changed condition can act without negotiating through an unclear hierarchy.

How should a supervisor use this explainer?

Before the task starts, ask the team to identify the current state, the evidence that supports it, and the event that would move the work into another state. That short conversation exposes whether the permit is functioning as a shared control or as a document that people assume someone else has checked.

Use the same questions during a field walk or management review. The strongest permit is not the one with the most boxes. It is the one whose state, boundary, and next decision remain clear when the job becomes different from the plan.

• Name the current permit state before work begins.
• Verify the evidence that supports that state in the field.
• Define the condition that requires suspension or revalidation.
• Assign a role to own each transition.
• Close out the task only after the operating condition is transferred.

Frequently asked questions

A permit-to-work is credible when it governs decisions across the life of the task. The useful test is whether people can explain what is authorized now, what would stop the work, and who verifies the next condition.