Plan the work. Keep control of the record.
Work-order and production examples show where routine record changes stop and a supervisor’s permit is needed. When connected, the demonstration changes fictional records. It does not operate equipment, release physical isolation or execute a database schema change.
Maintenance work order
A pump trips on a night shift. An agent raises and manages the work. The example approver is the shift supervisor.
An example permit table for this case. When the demonstration is connected, you can run it from the home page.
| Action | Limit | Who must say yes |
|---|---|---|
| Move the order between stages | this record, counted uses, a window | Within standing scopeNo additional approval within a valid standing permit. |
| Reserve parts from stores | this record, counted uses, a window | Within standing scopeNo additional approval within a valid standing permit. |
| Assign a crew | this record, counted uses, a window | Within standing scopeNo additional approval within a valid standing permit. |
| Record the isolation | one use, ten minutes, on a person's say | Needs a permitAn employee must permit it (the shift supervisor). |
| Record the work permit as issued | one use, ten minutes, on a person's say | Needs a permitAn employee must permit it (the shift supervisor). |
| Re-energize the equipment | Excluded from this workflow | Never in this workflowThis workflow does not permit this action. |
What the agent proposes
- Move the order to planningWithin standing scope
Proposed effect: status becomes planned.
- Reserve the seal kit and bearingsWithin standing scope
Proposed effect: parts reserved.
- Assign the night mechanical crewWithin standing scope
Proposed effect: crew assigned.
- Record P-204 as isolated and locked outNeeds a permit
Proposed effect: isolation recorded.
- Mark the example work permit as issuedNeeds a permit
Proposed effect: permit issued.
- Re-energize P-204 for a test runExcluded
Proposed effect: equipment energized.
- Mark the work completeWithin standing scope
Proposed effect: status becomes complete.
Production change
An alert fires at peak traffic. An agent proposes the fix. The example approver is the on-call lead.
An example permit table for this case. When the demonstration is connected, you can run it from the home page.
| Action | Limit | Who must say yes |
|---|---|---|
| Open or update the incident | this record, counted uses, a window | Within standing scopeNo additional approval within a valid standing permit. |
| Change the log level | this record, counted uses, a window | Within standing scopeNo additional approval within a valid standing permit. |
| Scale the service | one use, ten minutes, on a person's say | Needs a permitAn employee must permit it (the on-call lead). |
| Turn a feature flag off | one use, ten minutes, on a person's say | Needs a permitAn employee must permit it (the on-call lead). |
| Roll the configuration | one use, ten minutes, on a person's say | Needs a permitAn employee must permit it (the on-call lead). |
| Change the database schema | Excluded from this workflow | Never in this workflowThis workflow does not permit this action. |
What the agent proposes
- Open incident INC-3092Within standing scope
Proposed effect: incident opened.
- Raise the log level to debugWithin standing scope
Proposed effect: log level debug.
- Scale from 6 to 12 replicasNeeds a permit
Proposed effect: replicas 12.
- Turn off the new pricing flagNeeds a permit
Proposed effect: feature flag off.
- Drop the unused index to speed up writesExcluded
Proposed effect: schema changed.
- Resolve the incidentWithin standing scope
Proposed effect: incident resolved.
The questions that come first
- Who is the issuing authority?
- For a real workflow, your team must name who may issue, change and revoke permits. In the demonstration, the visitor requests permits while playing the supervisor. The current pilot does not produce a signed record authenticating that person as the issuer.
- Is the isolation field allowed in this workflow?
- The example excludes that record field. This site refuses to write a permit covering it, so the gate denies the proposed field change. That is not a claim that this pilot controls physical isolation equipment.
- What happens while a permit is missing?
- G-14 can hold an action until the named person decides; see the action lifecycle. In this demonstration, an action that needs a permit is denied; a later attempt can proceed once a covering permit has been issued.
- Will the record stand up in an investigation?
- Investigators can check each returned signed decision with a compatible ECL-1 verifier under their chosen trust policy. The demonstration uses public test keys, so a passing check shows the record is intact, not who made it or that an outside event happened. It does not authenticate the human issuer, establish complete event capture or prove private key custody.