Setting the policy gates for the company and per site

The policy gates decide what the system checks at each step of a permit. The setting is company-wide (it applies to every site), and a site can override it. A gate has three levels: Off (no check), Warn (the step can happen, but a justification is needed, and the reason goes into the signature chain) or Block (the step does not go through until the condition is met). A few rows are a switch, a time or a number instead; the risk assessment setting chooses among four options (see “The risk assessment setting” below).

The starting profile is OPEREX recommended. An organisation getting the permit module now receives its issuing policy with the values of the OPEREX recommended profile; organisations that were already running were moved to it once, in a single step. From then on the settings are yours: the system does not rewrite anything by itself.

Before you start

• Permission: managing templates and policy — ptw:manage.
• Loosening without a reason: saving a setting looser than the OPEREX recommended value asks for a reason (the “Deviation from the standard — a reason is needed” window, the Save with the reason button, at least 10 characters). Whoever holds the ptw:loosen_without_reason right (by default only the System administrator; it can be given to others in the permission matrix) saves without a reason — for setting up the company baseline. The loosening is still recorded: on the Permit settings → OPEREX standard tab’s deviation list, marked Accepted without a reason, by right (a reason can be added there later under Add a justification afterwards), and an audit record is kept of the save. Exception: enabling One-person issue (no requester) still asks for its own reason, even with this right — that reason goes into the chain and onto the paper of issued permits.
• Where to find it: Permit settings → Policy gates (this tab opens first).

What can be switched, and what cannot

Every signature step and reason requirement can be switched — acceptance, the on-site handover, the two-step hand-back and the reasons (the Steps and reasons group), plus “four eyes” at the countersignature and the other person rules (the Signatures group). All are ON by default; switching one off loosens the policy, so it asks for a justification. The additional signature moments of the Signatures group (extension, gas testing, LMRA, closure, workers at hand-back, blocks, template roles) are OFF by default: the organisation decides on them professionally. Not switches: the numbering, the statuses, the signature chain, expiry, and the fact that a permit with an expired time window cannot be activated. The issuer ≠ requester rule is loosened only by One-person issue, enabled with a reason.

Steps

Part of the page: the gate groups on the left, four gates out of many on the right. Below every row you can read where today’s value comes from.

The lifecycle chart with today’s settings of the V1 blokk site — not a clean profile: the site has 10 overrides of its own, for example Daily cut-off time is OFF in the image (18:00 in the OPEREX recommended profile). The Countersigned step is switched off, every other step shows its gates with today’s state.

1. Choose the scope. The Scope picker in the card’s top-right corner decides what you are editing: the Company — all sites row is the company-level setting (it applies to every site that does not override it; this needs access to every site), a site’s name is that site’s own setting.

2. Look at the lifecycle chart. At the top of the card, the Lifecycle — steps and gates chart shows the permit’s path under today’s settings: before every step (Draft → Requested → Issued → Countersigned → Accepted → Active → Handed back → Closed) its gates — signature, person, reason, check — each with its state today (on · off · warns · blocks · per template · system rule). A switched-off step is grey (“switched off — the permit skips it”); with one-person issue on, the Requested step is marked skippable with one-person issue. An on/off gate can be flipped on the chart too (click it — it saves, and asks for a justification when loosening, exactly as in the list); for a multi-state gate the page jumps to its settings row and highlights it. After saving, the whole chart updates.

   Under the Risk assessment step (step 0) stands the Risk assessment for the permit switch, its chip showing the name of today’s option: Not required · Optional, from the drop-down · Required, from the drop-down · Required, step 0. On Not required the step is grey and a permit can start without an assessment; with the two drop-down options the step is live (the assessment comes from the drop-down); on Required, step 0 every permit starts with a new ad-hoc assessment. Beside it stands the chip of Validity of a prepared risk assessment (months) (12 months or No expiry); it is live only with the two drop-down options, otherwise it is switched off.

   On the Issued step two always-on core guards stand for the risk assessment, which cannot be switched: The risk assessment prescriptions are met (or the deviation is justified), and If bound to a prepared assessment: the assessment is valid and not withdrawn. They measure at issue; extension, day close and handover do not check the assessment, so a permit already issued and running is not stopped by expiry or withdrawal.

3. Start from a profile, if you like. The Lenient, OPEREX recommended and Strict buttons of the Apply a profile: row ask for confirmation, because they set every gate of the chosen scope to the profile’s value — you can fine-tune them one by one afterwards. On every gate: Lenient ≤ Recommended ≤ Strict.

4. Find the category. The gates stand in ten categories, in the order of a permit’s life (Risk assessment and preparation · Issuing and approval · Steps and reasons · Signatures · Workers and competence · Certificates and gas testing · Working day, deadline and shift change · Hand-back and closure · Data retention · Printing). On a wide screen a jump menu on the left, on a phone one above the categories takes you there, and shows how many gates the category has and how many stand on the site’s own setting.

5. Set the gates one by one. Under each row’s title, the explanation tells you what happens on Warn and on Block. Below the control stands the source: the site setting · the company default · the system default · forced.

6. Look at the disabled rows too. What cannot be chosen today does not disappear either: it stands marked forced, with a ⚠️ reason (for example “Saved preparations have not been built yet.”).

7. The Printing group at the bottom of the page sets the paper’s layout (see Printing and PDF).

8. There is no separate save. Every change is saved automatically, right away: a dropdown or a tick when you switch it, a text or number field when you leave it (or press Enter). The bottom of the page shows “Saving…” and then the explanation again. Only switching profile asks for confirmation, because it rewrites every gate. If the change is looser than the OPEREX standard, the reason window comes up before saving (see above).

9. Review the deviations on the OPEREX standard tab. The Permit settings → OPEREX standard tab collects where the organisation deviates from the standard (see The OPEREX standard tab below).

A week of warnings before blocking

It is worth putting a new gate on Warn first: it shows everything (who proceeded with a justification, when and why), but stops nobody. Once your organisation is used to it, Block can come.

The gates

Gate	Lenient profile	OPEREX recommended profile	Strict profile	Watch out for
Risk sheet before issuing	Off	Block	Block	On a permit started from an assessment — ad-hoc or pre-prepared — the assessment satisfies it. So every issued job has a risk assessment: step 0, an attached assessment or a completed risk sheet.
Risk assessment for the permit	Not required	Not required	Required, a new assessment for every job (step 0)	Four options: Not required · Optional, from the drop-down · Required, from the drop-down · Required, step 0 — the order of the rollout matters. There is no warning level.
Validity of a prepared risk assessment (months)	12	12	12	A risk assessment prepared in advance for recurring jobs can be used for this many months (0 to 60); 0 = no expiry. Only adjustable with the two drop-down options. A value above 12 or no expiry asks for a one-off reason. An expired assessment cannot be chosen in the New permit drop-down, and a draft linked to it cannot be issued.
The approver must hold an OHS qualification	Off	Off	Block	Measured when a risk assessment is approved; a person record is needed.
The assessment’s permit proposal cannot be overridden	off	on	on	When on, the assessor cannot add a main hazard by hand or override the recommended permit type.
Completion of preparation tasks	Off	Warn	Block	The diary-side completion of the required preparation items.
On-site risk assessment (LMRA) before activation	Off	Warn	Block	Only affects templates with an LMRA block. For work with a pre-prepared assessment it is worth switching on the LMRA box in the permit template.
Work order required for the permit	Warn	Warn	Block	Not applicable without the Maintenance module.
Requesting company before the draft	off	on	on	When on, the worker picker narrows to the requesting company.
Cross-field rules	Block	Block	Block	The template’s rules; only Warn or Block.
Simultaneous operations (SIMOPS)	Warn	Warn	Block	Looks for a permit overlapping in time on the location branch and in the same plant.
Countersignature by the production lead	Off	In production areas	Always	Off: the policy asks for no countersignature (the template may still ask for one). Middle level: In production areas — when the work affects the energy supply of production.
One-person issue (no requester)	off	off	off	Asks for a one-time reason when enabled; the chain and the paper state it.
Standing (instruction-based) permits allowed	on	on	on
Supervisor acceptance (signature)	on	on	on	OFF: the on-site handover starts from the issued permit, and the acceptance gates (countersignature, worker acknowledgements) run there. Acceptance and handover can BOTH be switched off: then issuing (or, if a countersignature is needed, the countersignature) starts the work, and the permit can only be issued once its validity has started; worker acknowledgements can then already be recorded on the requested permit.
Issuer on-site handover (signature)	on	on	on	OFF: acceptance makes the permit active straight away.
Hand-back before closing (signature)	on	on	on	OFF: the issuer closes an active, day-closed or expired permit directly; if the template asks hand-back questions, they must be answered at closing.
Cancelling needs a reason	on	on	on
Suspending needs a reason	on	on	on
Extending an expired permit needs a reason	on	on	on	Extending a day-closed permit never asks for a reason.
Extraordinary close needs a reason and a note	on	on	on	The notification is sent regardless.
Passing a warning gate needs a reason	on	on	on	OFF: a warning can be passed without a reason; it is still recorded in the chain.
On-site declaration for issuing	on	on	on	The issuer declares being on site.
Two-factor confirmation at issue and close	off	off	on	A fresh code before issuing and closing.
The countersigner cannot be the issuer	on	on	on	OFF: the issuer may countersign their own permit.
Proxy recording: on behalf of the work supervisor	on	on	off	Acceptance and hand-back can be recorded by a user with an account on behalf of a work supervisor without one — name, manner (signed on paper / declared in person) and the recorder’s attestation are required; the chain records all three. OFF: only one’s own account can sign.
The acceptor is not the issuer	Warn	Warn	Block	The issuer accepting in their own name needs a justification (the chain records it); on block it cannot. With proxy recording, the named person is compared with the issuer.
Extension: the work supervisor signs too	Off	Off	Off	Per working day, before the extension; can be recorded on the supervisor’s behalf.
Gas tester signature	Off	Off	Off	Only on templates that ask for gas testing; per working day.
LMRA signature (per working day)	Off	Off	Off	Only on templates with an LMRA block; before the work starts and before every extension.
Closing: the production lead signs too	Off	Off	Off	Middle level: In production areas — when the work affects the production energy supply.
Hand-back: the workers sign too	Off	Off	Off	Per worker; can be recorded on the work supervisor’s device.
Block sign-offs before starting	Off	Off	Off	The template blocks that ask for a signature (e.g. isolation). With one-person issue the blocks must be signed before issuing.
Template role signatures	Off	Off	Off	The template’s own signer roles; a role bound to a field only asks for a signature when filled in.
The person handing back and the person taking back must differ	Warn	Warn	Block	The two STEPS come from the Hand-back before closing switch.
Competence expiry of the workers	Off	Block	Block	The template’s required-document list; the worker has to be linked to the Person register.
Own employees’ GENERAL documents block as well	on	on	on	Job-specific qualifications are always enforced.
Issuer training and written assignment	Off	Block	Block	The issuer has to be linked to the Person register too.
One person on one RUNNING permit at a time	off	on	on	Only runs for workers linked to the Person register.
New gas test for the extension	off	on	on
Certificates required by the template are attested	Off	Warn	Block	Only applies where the template asks for a certificate.
Contractor assignment with a reference number	Off	Warn	Block	The same for every template.
Valid gas test (re-test on extension)	Off	Block	Block	The verdict is given by the person measuring.
Photo at hand-back	Off	Warn	Block	Independent of the template photo points’ own requirement; without a point a general “Hand-back” slot is offered.
Every permit is valid for one shift	Off	Block	Block	By the site’s shift schedule (12 hours with 12-hour shifts); without a schedule it only warns. The template’s own “within one shift” flag blocks regardless.
Daily cut-off time	18:00	18:00	18:00	Site time; off = no daily deadline.
What happens at the cut-off	Automatic working-day close	Automatic working-day close	Automatic working-day close	Or Warn only, or Off.
Reminder before the cut-off (minutes)	60	60	60	The diary warns about the permits still open.
Validity beyond the cut-off is allowed	on	on	off	With a reason, and only if the template allows it too.
Shift-handover revalidation	Warn	Warn	Warn	There is deliberately no block level.
The reason for closing is mandatory	on	on	on
Recipients of extraordinary-close notifications	—	—	—	E-mail addresses; with an empty list no e-mail goes out.

The table shows the values of the three profiles (the rows in the order of the settings page), not your site’s current settings — the page and the lifecycle chart tell you those. In the OPEREX recommended profile every gate of the Steps and reasons group is ON; switching one off loosens the policy, so the page asks for a justification before saving (except for whoever holds the right to loosen without a reason — see above).

The risk assessment setting

The Risk assessment for the permit row (in the Risk assessment and preparation group; formerly Risk assessment required for the permit) is not a level but a choice among four options: it decides how a permit starts.

Option	Profile	On the New permit page	What happens to the assessment
Not required	The default; in the Lenient and OPEREX recommended profiles.	The usual form, no drop-down.	A permit can start without an assessment; an ad-hoc one can be made voluntarily from the menu.
Optional, from the drop-down	—	A Risk assessment drop-down: the pre-prepared assessments · “＋ New risk assessment (ad-hoc)” · “No risk assessment” (the default).	A permit can start without an assessment (“No risk assessment”).
Required, from the drop-down	—	The same without “No risk assessment”.	No permit is created or issued without an assessment.
Required, a new assessment for every job (step 0)	In the Strict profile.	New permit sends you to the assessment; no drop-down, no reuse.	A new ad-hoc assessment is made for every job.

A sentence under the row states the meaning of the chosen option. Switching among the four options never asks for a reason; on the OPEREX standard tab an option other than Not required shows as a ▲ tightens deviation, with nothing to do. The drop-down is described in Requesting a work permit; making and expiring assessments in Creating and approving a risk assessment.

A site where the assessment can be picked from the drop-down, with a 12-month validity. The picker was opened for the image — on the page it is a drop-down.

The Validity of a prepared risk assessment (months) row sets the lifetime of a pre-prepared assessment: 0 to 60 months, default 12, and 0 means no expiry. It is adjustable only with the two drop-down options; otherwise it is disabled, with a reason: “Only adjustable with the two drop-down options (Optional / Required from the drop-down).” A value looser than the OPEREX standard (12 months) — for example no expiry — asks for a one-off reason; shortening does not. The earlier of the expiry fixed at approval and the current months counts, so tightening takes effect immediately on assessments already approved, while loosening does not extend them.

The consequence of a change, before saving. When a save carries a risk, the page states in a What this change affects window what it causes, with a count — you confirm with Save anyway. There are two cases:

• when switching to a required option: “N existing permit draft(s) without a risk assessment can no longer be issued — a new draft with an assessment is needed instead.”;
• when shortening the validity: “N approved pre-prepared assessment(s) expire immediately — no new permit can be linked to them, and their linked drafts not yet issued cannot be issued either.”

Before switching to Required, from the drop-down: the page counts the affected drafts and saves only after Save anyway.

The additional signature moments (Signatures category)

The seven … also signs / … signature gates are Off in all three profiles — the organisation decides professionally which ones it needs. Switched on, the permit page shows the Further signatures card: every missing signature is a row with a Record signature button and, where the gate allows it (extension, gas testing, LMRA, template roles), an I record it on their behalf (no account) mode too (name + signed on paper / declared in person — the chain records that as well). The step’s gate (e.g. the extension or the work start) speaks at a missing signature according to Warn or Block.

• The extension, gas-tester and LMRA gates ask per working day: before the work starts, then again before every extension.
• With one-person issue (no requester) the block signatures must be given BEFORE issuing — issuing then starts the work in one step, and there is no point left to sign.
• The issued permit PDF carries signature rows only for the moments that are on: the done ones in a compact grid (name, date, Digitally signed or the recording mode), the open ones as rows to fill in. No paper-only row goes on an issued permit. The blank (template) form brings the rows of the enabled moments empty, and the Extension rows on the blank form parameter (0–8) of the Printing category sets how many extension rows it gets.

If it worked

After every change the page shows a notice naming what it saved (“Saved: …”, for example “Saved: Simultaneous operations (SIMOPS)”), and below the changed row the source becomes the site setting. If a value cannot be saved, the control goes back to the saved value and the reason stands next to the gate. The next permit step is measured against the new policy.

Common problems

What you see	Why	What to do
A red error under a row after saving	That gate’s value cannot be saved (the error stands next to the gate).	Correct that row and save again.
The row is forced, the control cannot be set	The gate cannot be chosen today (the page says why, with a ⚠️ reason).	Nothing to do — the gate goes live with the phase it names.
On the block level nobody can approve a risk assessment	The approvers have no person record or no valid qualification.	See Rolling out the risk assessment.

Worth knowing

The OPEREX standard tab

The standard is “the factory permit templates, the Recommended issuing policy and the base rule set of the risk assessment together”. The top of the tab names the company-level profile (“Company-level profile: …” — Lenient, Recommended (OPEREX standard), Strict or Custom), with these parts below:

• The list of deviations. With none, “No deviation: the organisation is on the OPEREX standard.” Otherwise the deviations stand in groups (Issuing policy — company, per site Issuing policy — <site> (own override), per template, and Risk assessment rule set), and the filter buttons narrow them by direction (▲ tightens · ● neutral · ▼ loosens · ✕ breaks). Every row states the values (“Standard: … → Yours: …”) and the handling: Fine — no action needed (a tightening or a neutral deviation), Loosening: a reason is needed, Accepted with a reason, or Needs a fix (a broken reference). The group’s button takes you to the place (Go to the policy, Open in the template editor, Open in the risk assessment template).
• A reason for a loosening. Under a row waiting for a reason stand the “Why do you deviate? (at least 10 characters)” field and the Save the reason button; if several rows wait in a group, one reason can cover them all (Save the reason for all). Under a row accepted by right, without a reason (Accepted without a reason, by right), Add a justification afterwards opens the same field.
• Sample jobs: what the deviations cause. Four typical jobs (Welding in a production area, Vessel entry (confined space), Crane lift, 20-hour job, Pump replacement with line breaking) run with the standard and with your settings; the table shows the signature steps, the number of blocking and warning checks, and the difference.
• Profile comparison. Per switch, the Lenient, Recommended and Strict values side by side, and in the Yours column today’s company-level value; a row that differs from Recommended is highlighted.

There is nothing to “switch on” on this tab: the list is computed from today’s settings, and a loosening can be justified there afterwards too.

More to know

• A template can tighten, but not loosen: where the template and the policy speak about the same thing, the stricter one wins.
• For the whole company at once: choose Company — all sites in the Scope selector; the setting then applies to every site that does not override it (this needs access to every site). Each row shows how many sites use their own value, and the ↺ Unify at company level button (confirmation: “Make every site follow the company settings?”) removes the site overrides in one step. A site override is marked site setting with a ↺ Use company value button.
• Separate per site: one site’s settings do not affect another; where there is no site value, the company default or the system default applies (the row shows which).
• The trail of a warning: the reason given for passing a Warn gate goes into the signature row, so it can be shown afterwards who let what through, and why. With Passing a warning gate needs a reason OFF, a warning can be passed without a reason — the warning itself is still recorded in the chain.
• A permit in progress never gets stuck: switching a step off only opens the new path. A permit already accepted can still be handed over; one already handed back can still be closed.
• One-person issue (no requester): when a request arrives on paper or verbally, this switch lets the issuer issue the draft in one step. Ticking it opens a reason field in the row; Enable with this reason saves it (at least 10 characters). The reason applies to every template and is written into the chain and onto the paper of every permit issued this way. Switching it off clears the reason — enabling it again needs a new one. On the normal issue path the “issuer ≠ requester” rule is unchanged.

Related

Rolling out the risk assessmentThe order in which to switch on the four options and the approver gate.

Issuing and the permit's lifecycleWhere the gates act: the steps.

Printing and PDFThe parameters of the Printing group.

Person register and documentsThe source of the competence gates.