Confined Space Permit: A Complete Guide

Of all the paperwork that passes across a maintenance desk, the confined space entry permit is the one I would want to look at first if I were judging how safely an organisation actually operates. Not because the form tells you much, but because of what the permit has to be founded on before it can honestly be signed. A permit for a confined space is a statement that a set of physical conditions has been established and verified, and that arrangements exist to get people out if those conditions change. Everything useful about the document flows from that. Everything dangerous about it flows from forgetting it.

The message up front: the permit is not the control. It is the record that the controls were established and verified before anyone went in, and the mechanism that keeps them under review while they are in there. A signed permit has never made an atmosphere breathable. Substituting the document for the state of the space is precisely how people die in confined spaces, and it is the single failure this article exists to argue against.

1. The permit is not the control

Start here, because the rest only makes sense once this is settled. Permits do not control hazards. Isolation controls hazardous energy. Cleaning and purging remove residues. Ventilation changes an atmosphere. Testing establishes what the atmosphere actually is. Continuous monitoring detects change. An attendant outside the space detects trouble and raises the alarm. Rescue arrangements get a casualty out. Those are the controls, and each one is a physical or human thing that either exists or does not.

The permit sits above all of that. It is a formal statement, made by somebody with the authority and the competence to make it, that those controls have been established for this space, for this work, at this time, and verified rather than assumed. It is also a communication device, telling everybody involved what has been done, what they are authorised to do, and what will happen if conditions change. And it is a control point, because the act of requiring a signature forces somebody to look before work starts.

The reason to be pedantic about this is that the failure mode runs in one direction. Nobody ever confuses a good permit for a bad atmosphere. What happens instead is that the paperwork becomes the thing that gets managed. The permit gets issued because the permit is what the audit looks for, and the tested condition of the space quietly becomes an assumption behind a tick. Teams in that state can produce a flawless permit file and still be sending people into spaces nobody has properly assessed. If you take one idea from this article, take the habit of reading a permit backwards: not "is this filled in", but "what physical state does this document claim, and who verified it".

The hazards themselves, and the control principles that address them, are a separate subject with its own depth. I have written those up in the confined space hazards, risks and controls guide, and the wider entry programme, the roles within it and the way programmes fail at the system level are covered in the confined space requirements and procedures pillar. This article stays on the permit itself: what sort of instrument it is, what it has to settle, and how it goes wrong.

2. The terminology and the legal variation, honestly

There is no single global rule that says "confined space entry requires a permit", and pretending otherwise leads people to look for the wrong duty in their own jurisdiction. The picture is genuinely different from country to country, and the honest version is more useful than a tidy one.

In the United States, federal law does formally distinguish between confined spaces in general and the subset whose entry triggers a specific regime. 29 CFR 1910.146, "Permit-required confined spaces", is the general industry standard, and it treats the permit-required confined space as a defined category with its own duties attached. That is where the phrase readers search for, "permit required confined space", actually comes from: it is a legal classification in US federal general industry, not a generic description. Two scope points matter. First, the general industry standard's scope excludes construction, agriculture and shipyards, and construction is dealt with separately under 29 CFR 1926 Subpart AA, "Confined Spaces in Construction", sections 1926.1201 to 1926.1213, made final in 2015. Second, many US states run their own OSHA-approved plans, and those can and do differ, so a US reader has to work from the version that applies in the state where the work happens rather than from the federal text alone.

In Great Britain the shape is different. The Confined Spaces Regulations 1997 (SI 1997/1713) require a safe system of work for confined space entry and impose duties around avoiding entry where reasonably practicable and having suitable emergency arrangements, but they do not frame the duty as a mandatory permit form in the way the US standard frames a category. The supporting document is the Approved Code of Practice L101, "Safe work in confined spaces", 3rd edition, December 2014. An Approved Code of Practice is worth understanding properly: it is not ordinary guidance, it carries a special evidential status in proceedings, so departing from it puts an organisation in the position of having to show that what it did instead achieved compliance. Note also that Northern Ireland has separate instruments, dated differently from the Great Britain set, so "the 1997 Regulations" is not the right citation for a reader in Belfast.

On permit systems generally, the widely used reference in English-speaking practice is UK HSE guidance HSG250, "Guidance on permit-to-work systems", 2005, written for the petroleum, chemical and allied industries. It is guidance and creates no duties of its own, and no international standard specifies how a permit to work system should be built. So where does the permit itself come from in the many jurisdictions that do not mandate one by name? From the duty to have a safe system of work, plus the practical impossibility of discharging that duty for confined space entry any other way. The permit is near-universal industry practice for satisfying the requirement, not a universally mandated form.

Management system standards reinforce the same logic without being law anywhere. ISO 45001:2018, as amended by Amd 1:2024, requires the hierarchy of controls at clause 8.1.2, and ANSI/ASSP Z10.0-2019 does the same at section 8.4 in the US. That is directly relevant here, because a permit is an administrative control, which sits low in that hierarchy. It is the last stop, not the first, and it never justifies skipping the question of whether entry can be avoided altogether. If you are new to how these layers relate, the hierarchy of controls guide sets out the ordering, and what HSE means as a discipline gives the broader frame.

3. What makes a confined space permit different from other permits

Most permits authorise a task. A hot work permit authorises an ignition source in a place where fire risk has been assessed and controlled. An electrical permit authorises work on a system that has been isolated and proved dead. The hazard is usually created by the work, and the permit contains the work.

A confined space entry permit is doing something structurally different. It authorises people to be inside a place whose condition can change while they are in it, and from which they cannot quickly get out. The hazard is not primarily the task. The hazard is the place, plus time, plus the restricted means of escape. That difference is not a nuance. It changes what the document has to do, and every one of the following consequences falls directly out of it.

• It must be founded on a tested atmosphere, not an assumed one. You cannot reason your way to the condition of an enclosed atmosphere from what the space used to contain or from what the drawing says is connected to it. Residues, biological activity, adjacent processes, coatings, ingress and the work itself all change it. The permit's validity rests on measurement by a competent person using appropriate, correctly functioning instruments, and on those results being recorded when they were actually obtained.
• It must define monitoring that continues during the entry. This is the consequence people most often miss. On a task permit, the pre-work checks are a gate you pass once. In a confined space, the conditions that made entry acceptable can deteriorate while people are inside, so testing cannot be a gate. The permit has to say what is monitored, how, by whom and with what response, for as long as anyone is in there. The applicable standard or code sets any required frequencies and limits; read it, and do not take intervals from an article.
• It must name who is outside and what they will do. A confined space permit has a role no task permit needs: somebody stationed outside, in contact with the people inside, whose job is to watch conditions, maintain communication, account for entrants and raise the alarm. The permit names that person and fixes their duties, because an unnamed attendant is no attendant.
• It must be founded on rescue arrangements that exist and have been checked before it is valid. The realistic emergency in a confined space is an incapacitated person who cannot self-rescue, and the response has to be arranged in advance, because the first available response otherwise is an untrained colleague going in after them. That is the classic multiple-fatality pattern. Arrangements have to be suitable for this space and this casualty scenario, and confirmed as available before entry, not named on the form as an intention.
• It must be visibly displayed at the entry point with the people inside accounted for. A permit in a folder in the site office is administrative. A permit at the entry point, with an accurate record of who is inside, is operational. It tells anybody arriving at that opening what is happening, and in an emergency it is the fastest answer to the only question that matters immediately.
• It must define the conditions under which the space is evacuated. Because conditions change, the permit has to pre-decide what triggers withdrawal, so that the decision is not taken by a tired person weighing schedule pressure against an unfamiliar alarm. Evacuation criteria decided in advance and briefed to everyone are the difference between a controlled withdrawal and an improvisation.

General permit theory, the parts common to all permit types, is covered in the permit to work complete guide, with the catalogue of permit types in types of permit to work and the closest neighbouring case, fire risk in an enclosure, in the hot work permit guide. The table below is the contrast I would draw for anybody who has run task permits for years and is now looking at their first entry permit.

4. Entry permit against general work permit: six differences that matter

5. What the permit must settle, and why

This is the substance of the instrument. I have deliberately written it as questions with reasons and failure modes rather than as fields, because a list of fields invites somebody to build a form from an article, and a form built that way will be missing the reasoning that makes it work. The questions are stable across jurisdictions; the way they are answered, and any values or periods involved, come from the applicable legal framework and the organisation's own assessment.

On isolation specifically, the relationship between locking out energy and authorising work through a permit trips up a lot of organisations, usually by treating one as a substitute for the other. The comparison is worked through in LOTO versus permit to work, and the isolation discipline itself in the lockout tagout guide. The assessment that has to sit underneath the whole permit is ordinary risk assessment practice applied to an unforgiving case; see the risk assessment guide. For technique selection, IEC 31010:2019 catalogues risk assessment techniques, and ISO 31000:2018 gives risk management guidelines, though it is guidance and there is no accredited organisational certification against it.

6. Entrant accounting: knowing exactly who is inside

This sounds like the most administrative item on the permit and it is one of the most important. Entrant accounting means knowing, at any moment, precisely who is inside the space, and positively confirming that everyone is out before the permit is cancelled and the space is closed or re-energised.

The reason is simple and it is about time. When something goes wrong, the response starts with a count. If the attendant can say immediately that two people went in, both are accounted for at the entry point, and nobody else is inside, the response is fast and correctly scoped. If the answer is "I think three, but one may have come out", the first minutes go on establishing a fact that should have been continuously known, and in a confined space those first minutes are most of the margin available. It is the difference between a rescue that begins in seconds and one that begins in minutes.

The other half is closure. Confirming the space is clear before cancellation is not a formality, because the consequences of getting it wrong are irreversible: re-energisation, refilling, purging, or simply sealing the access. Positive confirmation means somebody checked and can say so, not that nobody reported a problem. Where a site uses a physical token or tag exchange, its real value is that it makes the count a physical object rather than a memory, which is exactly the kind of engineering into the system that survives fatigue and shift change.

7. The lifecycle: assessment to cancellation

A permit is a process with a document attached, not a document with a process attached. The stages below are the sequence the instrument passes through, and the discipline lives in the transitions rather than in the paperwork at each stage.

• Assessment and preparation. The space is identified and assessed, the work defined, isolations planned and carried out, cleaning, purging or ventilation completed, atmosphere tested, and rescue arrangements confirmed. Almost all the real safety work happens here, before anything is signed.
• Issue. A competent authorised person who has satisfied themselves that the preparation is genuinely done authorises the entry. "Satisfied themselves" is load-bearing: it means having seen the space and the state of the controls, not having received a phone call.
• Briefing and acceptance. Everyone entering, and the attendant, are briefed on the space, the hazards, the controls, the communication method, the evacuation triggers and the rescue arrangements, and accept the permit. Acceptance is the point at which the people at risk demonstrate they understand the basis on which they are going in.
• Display. The permit is displayed at the entry point with the entrant record kept current, so the space's status is visible to anyone who comes near it.
• Entry and continuous oversight. Monitoring continues, the attendant maintains contact and the count, and conditions are watched rather than assumed. The permit is live during this phase, not dormant.
• Suspension. Conditions change, an alarm sounds, work stops for a break or a shift ends. The permit's basis is no longer demonstrated and the entry stops until it is re-established. This stage gets its own section below because it is where most of the serious failures cluster.
• Handback. Work complete, tools and equipment removed, entrants positively accounted for, and the space confirmed clear. Handback is the transfer of the space from the work party back to the operating organisation, and it should be as deliberate as the issue was.
• Cancellation and retention. The permit is cancelled, isolations are removed under control, and the record is retained. Retention is not filing for its own sake: the record is the evidence of what was verified, and it is the raw material for investigating anything that later goes wrong.

8. Suspension and re-verification: the stage that is skipped

One of the most common serious failures in confined space permits is resuming work on a permit whose conditions have not been re-verified. The reasoning that goes wrong is understandable, which is why it is so persistent: the space was tested, nothing obviously happened, the crew is coming back from a break, and re-doing the preparation feels like theatre.

It is not theatre, because the permit was never a statement about the space in general. It was a statement about the space at a moment, under a set of conditions that were then being actively maintained. Once that active maintenance is interrupted, the statement has expired in substance even if the form has not. Ventilation may have been switched off or knocked. An adjacent process may have changed. A drain or a connection may have been opened elsewhere on the plant by somebody with no knowledge of the entry. Residues may have continued generating vapour into a still atmosphere. The work already done inside may itself have changed conditions. None of these announce themselves.

The same applies at shift change, which is the other high-risk transition. A permit handed over between authorising persons or attendants carries all the assumptions of the first shift into the second, and the incoming people have no personal knowledge of the verification they are now relying on. A handover that re-establishes the basis rather than transferring a signature is the only safe version, and it is worth building the system so that the lazy path is the safe one: make resumption require a fresh verification step that cannot be satisfied by a conversation.

9. How confined space permits fail

These patterns are reported often enough to treat as predictable rather than unlucky. Each one breaks a specific principle, which is the useful way to look at them, because it tells you what the fix has to restore.

Notice the organisational pattern underneath the list. These permits are time-consuming to do properly, so they degrade under schedule pressure in ways that are entirely predictable: the steps that are slow and invisible go first, and the steps that leave a signature survive. That is why the authorising role has to be structurally protected from the pressure to sign. An authorising person who can be leaned on by a project manager is not an independent check, and the permit they issue is a schedule document wearing a safety document's clothes.

10. Entry permits inside maintenance systems

Most organisations of any size end up wanting entry permits connected to their maintenance system rather than living on a clipboard, and there are two genuinely useful things that connection can do.

The first is a space register linked to assets. If the enclosed spaces on site exist as records, with their assessment status and their identified hazards, and the assets inside or associated with them are linked to those records, then the space's status is discoverable rather than tribal knowledge. That matters most for the spaces nobody visits often, which are exactly the ones where an old classification decision goes unreviewed.

The second is surfacing entry requirements on the work order before mobilisation. If a planner raising a job against an asset inside a registered space sees, at planning time, that entry requirements apply, the preparation gets built into the plan instead of being discovered by a crew standing at an opening with a schedule to hit. That single piece of sequencing removes a lot of the pressure that degrades permits, because it moves the cost of doing it properly into the plan where it belongs. How work is classified and planned at that stage is covered in work order types in CMMS, and the mechanics of wiring permits into a maintenance system are in permit to work integration with CMMS.

The honest note, and I would say this to any client considering the investment: digitisation improves traceability and does nothing whatsoever for the quality of the assessment. A system can enforce that a field is completed; it cannot make the entry in that field true. It can timestamp a test result; it cannot make the test have happened at the point it claims. It can require an authorising signature; it cannot make the authoriser have walked to the space. Every failure mode in the previous section survives digitisation intact, and a well-designed workflow can make some of them faster and tidier. The gains are real but they are in evidence and coordination, not in judgement.

The idea to walk away with

A confined space entry permit is the record that a set of physical conditions was established and verified before people were authorised to be inside a place they cannot quickly leave, and the mechanism that keeps those conditions under review while they are in there. It is different from other permits because it authorises presence rather than a task, in an environment that can change around the people in it. That is why it rests on a tested atmosphere rather than an assumed one, why monitoring continues rather than gating, why somebody is named outside, why rescue has to exist before the permit is valid, and why suspension and re-verification are not bureaucracy.

Read that way, the permit is a useful and demanding instrument. Read as a form to be completed, it is worse than nothing, because it manufactures confidence that nobody earned. The organisations I would trust with entry work are not the ones with the best-designed permit. They are the ones where an authorising person is willing to say no, an attendant knows exactly who is inside, and nobody resumes work on yesterday's verification.

Final thoughts

Work from your own jurisdiction. If you are in US general industry the permit-required confined space regime is a defined legal category and you should read the applicable standard, along with your state plan if your state runs one, and the separate construction provisions if the work is construction. If you are in Great Britain, read the 1997 Regulations and the Approved Code of Practice, and remember that an Approved Code has evidential weight that ordinary guidance does not, with Northern Ireland sitting under separate instruments. Elsewhere, the duty is usually framed as a safe system of work, and the permit is how competent organisations discharge it. In all cases, the values, the periods and the equipment requirements come from the applicable document and from your own competent assessment, which is why none of them appear above.

The one thing that transfers across every jurisdiction is the framing this article opened with. The permit is not the control. If the conversation in your organisation is about whether the permit is filled in correctly, the conversation is in the wrong place. Move it to whether the conditions the permit claims were genuinely established, genuinely verified, and are genuinely still true right now, and the paperwork will look after itself.

Primary sources worth going to directly: US OSHA , UK HSE , ISO .

Related reading: Confined space hazards, requirements and procedures, Confined space hazards, risks and controls, Permit to work: complete guide, Types of permit to work, LOTO versus permit to work, Hot work permit requirements.