Work permit — paper check and evidence

On site it is the paper in your hand — but something may have happened in the system since: the permit may have been suspended, closed or extended. Scan the QR code in the header of the printed permit with your phone’s camera and the permit’s live status opens: its first sentence tells you whether work may proceed on the permit RIGHT NOW, and also whether the paper in hand is the latest version. No sign-in is needed — the site guard, the fire watch or a contractor can use it too. The Evidence check page verifies the signature chain of every permit in one go.

Before you start

• Permission: none for the live status (from the QR code) — it works without signing in. The Paper check and Evidence check pages need permission to view permits — ptw:view.
• Prerequisite: the paper of a printed permit that has already been submitted, or of an approved risk assessment.

What is on the printed permit — and what is not

The paper carries the number, the status at the moment of printing, every detail of the work, the workers, the conditions and the signatures, and one QR code in the top-right corner of the header. The paper prints no hash (“fingerprint”): for the people doing the work that would be unnecessary information — the machine evidence is carried by the QR code. The QR code is ONLY on the paper once the permit has a signature (that is, once it has been submitted); the paper of an unapproved risk assessment has no QR code either.

Steps

1. Scan the permit’s QR code with your phone’s camera and open the link. The link goes to your organisation’s own address; the page opens without signing in.

2. Read the verdict. It is in large letters: WORK MAY PROCEED — or DO NOT WORK, with the reason below (not started yet · suspended · work day closed · expired · handed back · closed · cancelled). The page shows the system’s current status, not the paper’s — it states an expired time window even while the permit’s status still reads “Valid”.

3. Check the paper line. “This paper is the latest version.” — or OUTDATED PAPER if something changed since printing (get it replaced), or “not a known version of this permit” (do not accept it).

4. Compare the paper with the page’s details (number, work, type, location, validity). The QR code proves which state the paper was printed from — not that nobody has altered the paper’s text since. The comparison tells you that. If you are signed in, the Open in the system link takes you to the full permit.

From the paper’s QR code, without signing in: the same paper that was printed when the site was handed over — since then it was handed back and closed, so “DO NOT WORK”, and the paper is outdated.

Older paper, risk assessment, no QR code — the Paper check page

Permits printed before 2026-09-28 and risk assessments carry a QR code with text (operex:ptw:…, operex:ra:…), not a link. You check these signed in: Evidence tab → Paper check, paste the copied text into the QR code content or document number field, then Check. For a permit, this page also opens with the verdict (work may proceed / do not work). You can also check without the QR code: type the document number from the header of the paper (PTW-2026-… or KE-2026-…) — the page then shows the document’s current state, and says that the paper’s state cannot be verified from the number alone.

The same with a paper printed before 2026-09-28 and its text QR, on the Paper check page (signed in): next to the verdict, the list also tells what happened since printing, by name.

If it worked

On the Paper check page, the paper-version badge is one of these:

• Latest paper — “The paper was printed from the CURRENT state: no new signature has been added since.”
• Outdated paper — the paper shows an earlier state; the What happened since the paper was printed list names the steps (which, who, when). This is not forgery, but the current state applies.
• No match — the QR code fits none of this document’s states: the paper is either not from this system, or the chain has changed.
• Not found — there is no document with this number on the sites you have access to.
• Chain not intact — the document’s signature chain cannot be recomputed today; the verdict is then not evidence.
• Current state (no QR) — you searched by number: the page shows the current state and does not measure the paper’s.

Checking all records

The Evidence check before it is run. It only reads: it repairs and closes nothing.

On the Evidence tab, the Run the check button verifies the signature chain of every permit and the content of every approved risk assessment on the sites you have access to. Damaged items go to the top of the table, named; with the Broken items only filter you see only those, and the result can be saved with Download CSV and Download PDF. The check can run once a minute, downloads twice a minute (each one re-measures everything). The check itself leaves a record in the system log.

The Detail column of a row with the Broken verdict names the reason and the signature’s sequence number (for example “Signature 3: the content hash does not match the recomputed one.”). Since 2026-09-28 there is a new reason, the hash rule: “Signature 3: unknown hash rule, or downgraded along the chain (an older rule after a newer one).” The system does not call such a chain intact.

A single permit’s chain is shown by the Signature chain card on the permit’s page: next to the server’s verdict (“The chain is intact: … signature(s).”), your browser recomputes it too (“Recomputed in your browser: …”) — that is your own device’s computation, not the server’s claim.

Common problems

What you see	Why	What to do
“The text cannot be read.”	You did not enter the whole QR text (from operex: to the end), or not a complete document number.	Copy the whole text again.
Not found	The document may be on a site you have no access to.	Ask the issuer or your administrator.
Chain not intact or No match for a paper you know is genuine	There is a discrepancy on the system side.	Run the Evidence check and tell your administrator.

Worth knowing

• It proves which state in the system the paper was printed from, and whether the document’s chain is intact today — so a permit rewritten inside the system afterwards is found out.
• It does not prove the paper’s text: a genuine QR code can be copied onto a forged paper. That is why you compare.
• Since 2026-09-28 the chain binds time and order too. Every new signature’s fingerprint covers, next to the signed content, the previous signature’s fingerprint, its sequence number and the signing time. So if someone rewrote an intermediate row or a signature’s time and adjusted only the next row’s pointer to match, the check finds it. Signatures made before 2026-09-28 keep being checked by their own, earlier rule — their fingerprints have not changed.
• Its limit: the chain is a keyless fingerprint. Someone who can write the database directly can recompute the WHOLE chain, and the Evidence check then stays green.
• Against retroactive rewriting at server level, the system also records a daily imprint of that day’s signatures outside the server — for the days already recorded, a recomputed chain is found out this way; checking it is an operations tool, not part of the interface. It has two stated limits: the most recent day only leaves the server the next day, and the imprint is written with the server’s own storage key — so today it does not protect against an attacker who controls the whole server (storage independent of the server is planned).
• The whole picture in one place: what a digital fingerprint is, how the chain, the database lock and the daily off-server record work together, and what the system does not prove — Digital fingerprints — technical brief.

Related

Printing and PDFThe paper, the QR code and the views.

Issuing and the permit's lifecycleWhich steps go into the chain as signatures.

Risk assessmentApproving an assessment and checking its content fingerprint.