Who issues and who signs a permit to work
roles, authority, and where the responsibility actually sits

A permit with the wrong name on it is worse than no permit: it looks like control while nobody has actually taken responsibility. The signatures are the point of the document — each one is a person saying “I checked this, and I am answerable for it”.

What three questions does a permit signature answer?

Every permit system in the world, whatever it calls its roles and whatever shape its wider permit to work system takes, answers the same three questions before work starts. Each one has to be answered by a named person, not assumed from the paperwork, before the first signature goes on the document.

1. Is the plant safe to release? — answered by the person who owns and understands the installation.
2. Is the crew ready to accept it? — answered by the person who will lead the work and answer for the people doing it.
3. Does anything else in the area conflict? — answered by whoever holds the overall picture of what else is running.

Competence is a decision, not a job title

Someone at the site has to have looked at this person, on this plant, for this permit type, and decided they are competent. That decision has three parts and all three are auditable: appointment (a written record naming the person and the scope), assessment (training plus demonstrated understanding of this installation), and currency (it was renewed, and it has not lapsed).

The most common finding after an incident is not a missing signature. It is a signature from someone whose appointment did not cover that permit type, that area, or that period. When that happens the authorisation is treated as absent, and the responsibility moves to whoever appointed them.

What does each signature actually mean?

Each signature on a permit is one named person accepting responsibility for a single fact, not a formality repeated four times. The issuing signature answers for the plant, the accepting signature answers for the crew, the gas test signature answers for a reading, and the closing signature answers for the handback — and none of the four can stand in for another.

• The issuing signature says: I have made this equipment safe by the means listed here, and I have proved it, and nothing I know of will change while this permit runs.
• The accepting signature says: I have read these conditions on site, I understand what may not be done, and my crew has been briefed on it.
• The gas test signature says: I took these readings myself, at that place and time, with an instrument in calibration.
• The closing signature says: work is finished or stopped, people and tools are out, guards are back, isolations are ready to be removed.

That last one is the one people skip, and it is the one that hands a live hazard to the next shift.

Who signs when a job crosses two areas of responsibility?

A job that spans two areas — a pipe rack running between two units, a scaffold built against a boundary drawn on the plot plan — is not simply “in” one area or the other, and no permit can borrow authority from ground its issuing authority never released. Every area the job physically touches needs its area authority involved before work starts, either signing directly or formally naming which one leads.

1. Identify every area the job actually touches — not the area where the crew starts, but every area a hose, a scaffold pole or a cable run crosses.
2. Get every area authority involved to agree, in writing, who leads. One is named lead for that permit; the others confirm in writing that the job does not conflict with anything running on their side.
3. Any change to the job’s footprint reopens the question. A scaffold extended ten metres, or a trench found to run under a neighbouring unit’s cable route, is a new boundary case, not a continuation of the old agreement.

Where the boundary itself is unclear — no marked line on the plot plan, or two systems describing the same ground differently — the job does not start until both area authorities have walked it together and agreed where the line actually falls. A permit signed on the assumption that “someone else must have checked the other side” is exactly the assumption an area authority exists to remove.

Delegation, handover and shift change

Authority can be delegated only to someone appointed for the same scope, and the handover must be face to face with the permit in hand. A permit does not survive a shift change on its own: either it is formally handed over and re-signed, or it is closed and a new one is raised. “It was still valid” is not an answer if nobody on the incoming shift knew the job was running.

At the moment of handover the outgoing signatures do not simply carry forward — they are tested again, on the spot, by the people taking over:

1. The outgoing issuing authority walks the permit and the plant with the incoming one, pointing at each isolation and each reading already recorded on the document.
2. The incoming issuing authority countersigns as accepting the permit as it stands, or refuses it and requires re-verification of whatever cannot be confirmed from the walk.
3. The performing authority does the same on the work side — briefing the incoming supervisor and the crew coming onto shift, not handing over a clipboard with nobody present to answer for it.
4. Anything not confirmed on the walk is treated as unverified, whatever the paper says, and is re-tested before work resumes.

A permit closed without this walk, or renewed by a signature added from an office, has not actually been handed over — it has been extended on trust, which is the one thing a permit exists to remove.

Who signs when a contractor works on someone else’s site?

On most industrial sites the crew doing the work is not employed by the operator who owns the plant, and the permit is where the two companies formally meet. The division of the signatures does not change with the badge on anyone’s overalls: the issuing authority stays with the operator, because releasing the plant as safe requires knowing the plant, and that knowledge cannot be subcontracted. The performing authority sits with the contractor’s supervisor, because answering for the crew requires knowing the crew.

Which system governs, and how the bridging document fixes it

Which permit system actually governs is decided before mobilisation, in a bridging document, not negotiated once the crew has already turned up on site.

1. State which operator’s permit system is the one raised and signed — usually the host’s, because the plant is on the host’s site, whatever procedures the contractor runs internally.
2. List every point where the two companies’ rules diverge — competency requirements, gas testing frequency, isolation standards — not only the ones somebody happens to remember.
3. Apply the stricter requirement at each point of divergence, named explicitly rather than left as “whichever is safer” for the crew to judge on the day.
4. Both companies sign the bridging document before the first permit under it is raised, and it is reviewed whenever either company’s own procedure changes.

The stakes of skipping this step show up plainly on sites that run their own binding system. ADNOC’s Work Management System, standard ADNOC-HS-S-006, folds the job safety analysis, energy isolation and simultaneous-operations control into a single workflow that binds every contractor on an ADNOC site, whatever that contractor runs at home — there is no version of the rule where a visiting company’s own procedure substitutes for it. Where the host’s own procedure is itself given legal force — Petroleum Development Oman’s PR-1172, tied to Ministerial Decision 286/2008 — a contractor’s own system has even less room to compete with it. A contractor arriving without having read the host’s system in advance discovers this on day one, at the cost of a stopped job.

Two failure patterns that recur at this interface

• The contractor’s supervisor signs without walking the job. Accepting a permit from an office chair means accepting conditions nobody has looked at. The acceptance signature is given at the worksite, with the isolations pointed at, or it means nothing.
• Sub-subcontractors appear on nobody’s permit. Every person at the worksite is under some permit’s crew list. A rigger borrowed for an hour from the neighbouring job is either signed on, or sent back.

Electronic permits: what changes and what must not

Digital permit systems change the mechanics of the signature — a login instead of a pen — and that is acceptable in most jurisdictions as long as three properties hold: the record is attributable (one account, one person, no shared logins), time-stamped, and immutable after signature (corrections are new entries, not edits). What must not change is the meaning: an approval tapped from the canteen has exactly the value of a paper permit signed without a site walk — none. A good electronic system makes the walk harder to skip, by tying the gas reading, the location and the acceptance together; a bad one makes skipping it frictionless. When choosing or auditing one, that is the question to ask: does it prove the check happened, or merely that a button was pressed? In practice most sites run both for a while — paper at the gate, a digital record in the office — and that overlap is where permits go missing: a job closed in one system stays open in the other.

How an auditor reads the signature block

Auditors rarely start with the hazards; they start with the names, because the names fail faster. The standard passes are worth knowing because they are the same passes an investigator makes after an incident:

1. Does each signatory hold a current appointment for this permit type in this area?
2. Is the gas test signed by the person who took the readings, with time and instrument recorded?
3. Are acceptance and issue signed by different people?
4. Does the crew list match the people who were actually at the worksite?
5. Was the permit closed — and by someone entitled to close it?

Five questions, all answerable from the document itself. A permit that survives them was probably a real control; a permit that fails the first one was paperwork, whatever else it says.

Stop-work authority

The right to stop is deliberately the widest right in the system. It belongs to the issuing authority, the area authority, the supervisor, the attendant, the fire watch and the person holding the tool. It needs no explanation at the moment it is used, and a site where it is used and then quietly punished does not have a permit system — it has a filing system.

Frequently asked questions