Process digitalisation · Authorisations
Managing roles and authorisations in LOTOTO
On paper, authorisations are checked by signature and trust. In a digital process they are part of the workflow: an operator approves only equipment they are responsible for, an electrician isolates only electrical energy, and when someone stands in, the record shows who actually carried out the task.
Authorisations are checked in the record, not later in an audit.
How do authorisations work in digital LOTOTO?
Short answerThey combine three things: the user’s role in the system, their task in a specific record, and restrictions by energy type or equipment.
The role defines what a user may do in the system at all, such as approving requests or managing the equipment register. The task in a record shows who is the requester, who the authorised person and who the operator for a particular job. Restrictions ensure that each person acts only within their scope.
Authorisations are therefore not checked after the fact. The system will not let an energy be assigned to a worker who may not isolate it, and it will not let an operator approve equipment outside their scope.
Which roles can take part in the process?
Short answerFor example a requester, authorised person, operator, health and safety technician and administrator. This is an example from an existing deployment, not a mandatory scheme.
| Role or task | What it does in the process |
|---|---|
| Requester | prepares the record, selects equipment and authorised persons, completes the work |
| Authorised person | isolates the assigned type of energy, confirms lockout and unlocking with the lock number |
| Operator | checks and approves requests for equipment within their scope |
| Health and safety technician | is notified for specified high-risk work |
| Administrator | manages users, equipment, templates and system settings |
Example from an existing deployment. Role names, their number and the split of responsibilities are configured according to your site’s rules.
On your site the same tasks may go by other names, such as person in charge, equipment owner or shift supervisor. What matters is that every task in the permit to work has a clearly defined owner.
Which energies can a worker isolate?
Short answerOnly those that match their worker type. Worker types are linked to energy types, so an electrician, for example, can only isolate electrical energy.
When a record is prepared, an authorised person is assigned to each energy of the equipment. Linking worker types to energy types prevents isolation from being confirmed by someone who, under your rules, is not qualified for it. Which worker and energy types you distinguish depends on how your work is organised.
ReadEnergy isolationCan authorisations be limited to equipment or an operating area?
Short answerYes. An operator’s right to approve can be limited to specified equipment, for example the equipment of one operating area.
The decision about a job is thus tied to the scope of a specific person’s responsibility. An operator on one line does not approve lockouts on another line they do not know. How equipment is grouped is agreed during implementation, based on how your site is organised.
How does substitution work?
Short answerAn assigned task can be taken over by another authorised worker from a configured substitution group. The record keeps who actually carried out the task.
Substitution groups can be set up for both authorised persons and requesters – for example for workers on the same shift. If the originally assigned person is unavailable, a substitute carries out the task and the record shows who stood in. One person’s absence does not stop the process, and the information about who did what is not lost.
Substitution is common at shift changes and when several work groups are on the same equipment. The wider context is on the Group lockout page.
Can a substitute remove someone else’s personal lock?
Short answerNot automatically. Taking over a task in the application does not authorise anyone to remove another worker’s personal lock.
When personnel change, continuous physical protection must be maintained according to the procedure defined by the site. How a personal lock is handed over, or who may remove it and under what conditions, is a site rule, not a software setting. The US regulation OSHA 29 CFR 1910.147 also highlights maintaining protection during personnel changes; we use it as a technical frame of reference, not as a substitute for applicable regulations.
If handing over a key, lock or tag is part of your procedure, the solution can be extended to record it, depending on site requirements.
Why is a system administrator not automatically authorised to work on equipment?
Short answerBecause technical administration of the system and competence to work on equipment are two different things. The administrator manages users and settings, not energy isolation.
The administrator is often someone from IT or from the department that runs the system. Access to settings does not make them competent to isolate energy or decide on a job. Company rules should keep these responsibilities clearly separate. During implementation we recommend granting administrator access sparingly and regularly reviewing who holds which authorisations. Actions in records and data changes are captured in the audit trail.
How are roles set up for your site?
Short answerAccording to your internal rules. We start from who requests, approves and isolates today, and carry those responsibilities into the system.
During the analysis we go through your existing procedures, organisational structure and worker types with you. Together we define equipment groups for approval and substitution groups. The full implementation approach is described on the Solution page, the wider context on the Digital LOTOTO page.
What do system authorisations not replace?
Frequently asked questions
Do we have to use the roles from the example?
No. The example comes from an existing deployment. Role names and the split of responsibilities are adapted to how your work is organised.
Is the health and safety technician informed about high-risk work?
Yes. For specified work, such as hot work, work at height or confined space entry, they are notified in the application and by email.
How do workers log in?
Through a web browser on a computer, tablet or phone. Depending on site requirements, the solution can be extended with RFID card login, for example at a kiosk workstation.
Next step
Let’s go through your roles and responsibilities.
Tell us who requests, approves and isolates on your site. We will show you how those rules would carry over into a digital LOTOTO process.