What is a permit to work
the system behind the signature, and what it has to prove before anyone starts

Welding on a live plant, entering a vessel, working over a drop, touching a circuit that is normally energised — none of it starts because a worker decided it looked safe. A permit to work is the document that makes that decision in writing, before the first tool is picked up: what is allowed, who is answerable for it, and what has to be proved first.

In short

• A permit to work (PTW) is a written or digital authorisation for one named crew to do one hazardous job, in one place, for a fixed period — not a general safety procedure and not a risk assessment.
• It exists because the hazards it controls are invisible or delayed: a gas that cannot be smelled, a circuit that looks dead, a fall that is over before anyone can react.
• Two signatures are universal everywhere it is used: an issuing authority, who releases the plant as safe, and a performing authority, who accepts the job and answers for the crew.
• The permit type follows the dominant hazard, not the trade — a fitter with a grinder needs a hot work permit, a fitter entering a tank needs a confined space entry permit, and a job can need both at once.
• Every permit carries an expiry. When it lapses, the work is unauthorised whether or not the job is finished.
• The paperwork and the exact numbers differ by country and by operator — OSHA in the United States, GB 30871-2022 in China, Saudi Aramco’s GI 2.100 in the Gulf — but the underlying sequence is the same everywhere: identify the hazard, isolate it, prove it, sign it, expire it.

What is a permit to work?

A permit to work is a written or digital authorisation that allows one named crew to carry out one specific hazardous job, in one place, for a fixed period, only after the hazards have been identified and the required precautions have been proved rather than assumed. It is the moment two people agree, in writing, that a job may start: what will be done, where the authorisation stops, what has already been isolated or tested, and who is answerable if any of that turns out to be wrong. It is not a general safety policy, and it is not the same as a risk assessment — most systems require the risk assessment as an attachment to the permit, not as a substitute for it.

The name causes a genuine mix-up online. Search “work permit” and the results are about immigration — a government’s authorisation for a foreign national to hold a job in a country, issued by a labour or interior ministry. That is a completely unrelated document, and the difference between a permit to work and a work permit is worth reading in full if that is what actually brought you here: the two share nothing but the word “permit”.

Inside industrial safety the vocabulary is more consistent, if not identical. Most systems speak of a permit to work, a PTW, or a safe system of work built around one; some operators use their own terms for the same underlying roles — Saudi Aramco’s GI 2.100, for instance, calls its signatories the permit issuer, permit receiver and approving authority, rather than issuing and performing authority. Whatever the local vocabulary, the document underneath answers the same three questions on every site: is the plant safe to release, is the crew ready to accept it, and does anything else in the area conflict with this job.

Why does a site need a permit to work?

Because the hazards a permit controls cannot be judged by looking, and cannot safely be left to a verbal instruction. A tank that has held product for years can be gas-free at eight in the morning and dangerous by noon, as sludge on its walls warms and gives up vapour again. A breaker racked out and a drawing marked “isolated” are both claims, not facts, until a test at the point of work confirms them. A fall from height is over in under a second, which means every decision that determines the outcome — the anchor, the exclusion zone below, the rescue plan — has to be made before the work starts, because there is no time to make it during.

A permit to work forces that sequence. It will not let a job begin until someone has actually taken the gas reading, actually proved the circuit dead, actually inspected the access — and it records who did each of those things, and when, so the check survives past the moment it was made. Without a permit, “isolated” and “tested” are things a crew is told. With one, they are things a named individual is answerable for, and the record of that answerability is the only evidence, afterwards, that the check happened at all.

The same discipline explains why every permit expires. Conditions on a live plant move hour to hour — a line that was gas-free at the start of a shift is not necessarily gas-free at the end of it — and a permit that could quietly roll from one shift into the next would be authorising work against conditions nobody has re-checked. Every mature permit system treats the expiry as absolute: extending the work means re-testing and re-signing, not extending the paper.

What are the main types of permit to work?

Four hazard categories account for most permits raised on an industrial site: fire, atmosphere, height, and electrical energy — hot work, confined space entry, work at height and electrical isolation. Beyond those four there is no single global list: the permit type follows the dominant hazard in the job rather than the trade doing it, and different operators split or combine the remaining hazards differently, which is why a site’s own permit schedule always has the final word over any general guide, including this one.

Hot work permit

Any job that can produce a flame, an arc, a hot surface or flying sparks — welding, cutting, grinding, brazing, even a non-classified power tool used in a classified area. The hot work permit has to prove the atmosphere has been tested, combustibles are cleared or protected within a set radius, and a trained fire watch stays in place for a defined period after the last spark: one hour under NFPA 51B in the United States against a thirty-minute regulatory floor under OSHA, and a fire graded by level under China’s GB 30871-2022, where the grade decides who has authority to approve it.

Confined space entry permit

Any vessel, pit, sewer, silo or tank with limited means of entry and exit that is not designed for continuous occupancy and can hold a hazardous atmosphere. The confined space entry permit exists because the danger is the air, not the size of the opening: oxygen is tested first, then flammable gas, then toxic contaminants, in that order, because a combustible-gas sensor needs enough oxygen present to give a correct reading. Mexico’s NOM-033-STPS-2015 makes written authorisation for entry a legal requirement in its own right, and most Gulf operators run it as its own permit type with a dedicated, certified gas tester.

Work at height permit

Any position from which a person could fall far enough to be injured, where the structure does not already prevent it — scaffolding, mobile elevating platforms, roof work, structural steel, rope access, even a ladder used for two-handed work. The work at height permit has to prove the access has been inspected, the fall arrest anchor is rated and independent of whatever supports the platform, and rescue has been planned rather than left as “call for help”. Where fall protection legally starts differs sharply by country: 1.8 m under OSHA 1926 Subpart M in the United States, 2 m under China’s GB 3608-2025, and no fixed threshold at all under the United Kingdom’s Work at Height Regulations 2005, which asks only whether a fall from that position could injure someone.

Electrical isolation permit

Any work that exposes a person to a conductor normally live, or to the energy released when one fails — panel entry, cable termination, motor and drive maintenance, work near overhead lines. The electrical isolation permit, often run in practice as lock-out/tag-out, exists because a switch labelled off is a claim, and only a voltage test at the point of work turns it into a fact. The five safety rules in EN 50110-1 — disconnect completely, secure against reconnection, verify the installation is dead, earth and short-circuit where required, protect against adjacent live parts — underpin most systems worldwide, including the operator systems used across the Gulf.

Other permit types

Most sites also run permits for hazards that do not fit neatly under the four above:

• Excavation permit — for digging and trenching: buried services surveyed and marked before the first cut, shoring or battering matched to the ground conditions, and the atmosphere tested at depth, because a trench collects heavy vapours the same way a confined space does.
• Lifting permit and lift plan — for crane and hoist operations: a lift plan with weights, radii, ground bearing and wind limits, certified and inspected equipment, and an exclusion zone that no load is carried over.
• Line breaking permit — for opening process equipment that has held product: contents identified and depressurised, isolation by blank or by double block and bleed listed item by item, and the first break made loosely with somewhere for any residue to go.
• Cold work permit — for routine maintenance with no ignition source, used across the Gulf under systems such as Saudi Aramco’s GI 2.100: a bounded scope, isolation of any energy source involved, and an automatic upgrade to a hot work permit the moment a spark-producing tool appears.
• Radiation work permit — for radiography and radioactive sources: barriers and dose rates measured at the boundary rather than assumed, and source accountability from the moment it leaves storage to the moment it is signed back in.
• Pressure test permit — for testing pipework and vessels under pressure: the test medium and pressure set by written procedure, water preferred over air wherever possible, and an exclusion zone held for the whole time pressure is on.
• Temporary power permit — for supplies rigged for the duration of a job: rating matched to the area classification, residual current protection tested on the day, and a removal date written on the permit itself.
• Road breaking and blinding permit — for work that affects site access or process pipework at once: emergency vehicle access kept open or formally re-routed, and every blank fitted into the system logged by number.

Sorting a specific job into the right type, under the rules that apply where it is happening, is exactly what the permit selector is built to answer.

What does a permit to work actually contain?

Strip away the site-specific form, and every valid permit is making the same five commitments.

1. The job, bounded. What will be done, and exactly where the authorisation stops — a permit for “tank cleaning” and a permit for “tank cleaning and hot work inside the tank” are not the same document, and treating them as interchangeable is one of the more common ways a permit fails in practice.
2. The hazards, named. Fire, atmosphere, stored energy, height, load, radiation — whatever applies, stated outright rather than assumed from the job title.
3. The isolations, proved. Not “isolated” as a description, but isolated and demonstrated: a valve locked and tagged, a circuit tested dead, a line blinded and listed by number rather than covered by the phrase “all lines isolated”.
4. The measurements, recorded. Every gas reading, every voltage test, with the time it was taken and the name of the person who took it. A reading without a name and a time cannot be judged stale, which is exactly why it has to be treated as stale.
5. The window, closed. A stated expiry after which the authorisation is gone, and a closing signature that says the job is finished, the people and tools are out, and the plant is safe to hand back.

None of those five is decorative. Remove any one of them and the document stops being a control and becomes paperwork that merely looks like one.

Who signs for each of them is not left to whoever happens to be available. Two roles appear in every serious permit system, whatever the local name for them is: an issuing authority, who owns the plant and answers for releasing it as safe, and a performing authority, who accepts the stated conditions and answers for the crew carrying out the work. Larger sites add an area authority to catch conflicts between jobs running in the same place at the same time. Who issues and who signs a permit is worth reading on its own, because more incidents trace back afterwards to the wrong person having signed than to a control that was genuinely missing from the form.

Where does the system break?

Rarely on the form itself. The same five patterns recur across every permit type, whatever the hazard:

• A reading taken at the wrong time or the wrong place. A gas test recorded an hour before work started rather than at the point of work, or a voltage test skipped because the panel front already looked safe.
• A control quietly downgraded under time pressure. A fire watch given a second job. An attendant pulled away for ten minutes. An anchor point chosen by eye because the rated one was inconvenient to reach.
• A permit rolled into the next shift without re-verification. Conditions that were true at the start of a shift get treated as still true at the end of it, when nobody has actually gone back and checked.
• Nobody closes the permit. The job finishes, the crew leaves, and the closing signature — the one that says isolations are ready to be removed and the plant can be handed back — is never made. The next shift inherits a live hazard nobody told them about.
• Two rule sets collide, and neither one clearly wins. An international contractor works to its own procedures on a client’s site, and nobody agreed in advance which requirement governs when the two disagree.

That last pattern is where geography starts to matter. The engineering behind a permit to work is close to identical everywhere — identify the hazard, isolate it, prove it, sign it, let it expire — but the paperwork, the mandatory status of the written form, and the exact numbers sit with the jurisdiction and the operator running the site.

Where two systems apply to the same job — a contractor’s own procedures and the client’s — the rule that survives an audit is the same everywhere: apply whichever requirement is stricter, and write down which one was applied. Iran and most contractor sites without a named national instrument of their own run on the operator’s or main contractor’s form; the controls described across this guide are the minimum an auditor will look for, regardless of what the form is called locally.

Frequently asked questions