Types of Permit to Work Explained

My twenty two years are in maintenance and permit systems rather than in issuing permits or in safety practice: I build the software that carries permits to work, the registers, the approval routes, the links between a permit and the work order it authorises. That work means reading a lot of permit category lists in order to configure them. The sites I have configured systems for each have a different list of permit types, every list is defended as obvious, and a number of them contain at least one category nobody present can explain the purpose of. The categories are not arbitrary, but they are not universal either. They are the residue of one site's hazards, one sector's practice and one jurisdiction's law.

The message up front: there is no universal set of permit types. A category exists because a hazard on that site needs a named authorisation gate in front of it, and the categories in force at any location, together with the conditions each carries, are set by that site's own permit system under the applicable law. This article is a general explanation of permit categories, not a permit system: the set you adopt and the conditions attached to each must be determined by a competent safety professional against the law that applies to you and the hazards you actually have.

Everything below assumes you know what a permit to work is and how one moves through request, authorisation, issue, handback and cancellation. If you do not, start with the complete guide to permit to work, which owns the concept, the roles and the failure modes.

1. Why there is no universal set of permit types

Permit to work is not established by a single international standard. There is no ISO permit standard to conform to and no globally numbered list of categories. The most widely used published reference in English is UK HSE guidance HSG250 , "Guidance on permit-to-work systems: A guide for the petroleum, chemical and allied industries", published 2005 and free to download. It is guidance creating no duties of its own, written for a particular set of industries, and it remains the best single document on the subject, which tells you how thin the field is.

In Great Britain the duty arises under general health and safety legislation, principally the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999 (SI 1999/3242), whose risk assessment duty sits at Regulation 3. Neither says "permit". They say assess the risk and put adequate arrangements in place, and a permit system is how a competent employer discharges that where standing instruction is not enough. Certain domains carry their own specific instruments, and where one does the permit stops being a matter of judgement and becomes closer to a legal expectation. Northern Ireland legislates separately with different years, so a Great Britain citation is not automatically a United Kingdom one. In the United States, federal law under 29 CFR imposes named permit regimes on some hazards and not others, with State Plan states free to go further. In the Gulf, where I work, neither set has legal force.

So the same activity can carry a legally mandated permit in one country, a customary permit in the next and a method statement with none at all in a third. Some categories are near universal in practice because the hazard is; others exist only where a particular process or regulator puts them there. The useful question is never "what are the types", it is "what hazard does a separate category earn its place by controlling". Where a domain is governed by legislation I cannot cite precisely for your jurisdiction, I send you to yours rather than guess.

2. Hot work and confined space entry

Hot work covers any activity introducing an ignition source into an environment that may contain flammable material: welding, cutting, grinding, brazing, open flame, work producing sparks or sustained heat. The hazard that justifies it is not the heat but the meeting of an introduced ignition source with a fuel nobody has looked for, inside a wall void, in a drain, in residue coating a vessel, in dust accumulated on a beam for a decade. What makes hot work distinct is delayed ignition. Most hazards here resolve when the work stops; hot work does not. Heat conducted through a steel member, a spark that travelled through a gap into insulation, an ember smouldering in debris: any of these can become a fire long after the crew has left, which is why the monitoring period after work finishes is the substance of the category rather than an afterthought.

In the United States, federal general industry rules for welding, cutting and brazing sit in 29 CFR 1910 Subpart Q, sections 1910.251 to 1910.255, with the permit concept in 1910.252(a) and, for covered process safety management processes, 1910.119(k). There is no OSHA standard titled "Hot Work Permit", and 1910.252 is titled only "General requirements". The recognised consensus document is NFPA 51B, "Standard for Fire Prevention During Welding, Cutting, and Other Hot Work", currently the 2024 edition; NFPA 51 is the oxygen fuel gas hardware standard, not the permit document. NFPA publications come from a United States private body and are not law in themselves, so what binds you is the edition your authority having jurisdiction adopted. Commonly got wrong: treating the fire watch and monitoring period as a formality to shorten when the crew is needed elsewhere. Hot work in full belongs to hot work permit requirements and hot work hazards and controls.

Confined space entry covers entry into any enclosed or partially enclosed space where the enclosure itself creates or magnifies a risk: tanks, vessels, sewers, pits, silos, ducts, voids, and spaces that are not obviously confined until somebody is inside one. Four hazard families justify it: atmosphere, because a space can be oxygen deficient, oxygen enriched, toxic or flammable with none of that apparent from outside; engulfment, because free flowing solids and liquids behave in an enclosure in ways they do not in the open; entrapment, because geometry that is easy to enter can be impossible to leave while unconscious; and heat, because an unventilated enclosure removes the body's ability to shed it.

What makes it distinct is that rescue must be arranged before entry rather than improvised afterwards, because the people most likely to die are the untrained colleagues who follow the casualty in. This is also one of the categories genuinely codified rather than customary. In Great Britain the Confined Spaces Regulations 1997 (SI 1997/1713) apply, supported by the Approved Code of Practice L101, "Safe work in confined spaces", third edition, December 2014, an ACOP carrying special evidential status rather than being ordinary guidance; the Northern Ireland instrument carries a different year, 1999. In United States federal jurisdiction, 29 CFR 1910.146 covers permit required confined spaces in general industry and expressly excludes construction, agriculture and shipyards; construction is 29 CFR 1926 Subpart AA, sections 1926.1201 to 1926.1213. Commonly got wrong: classifying by whether a space looks confined rather than by whether the enclosure creates the risk. Full treatment sits in the confined space permit guide and confined space hazards and controls.

3. Electrical work, line breaking and pressure systems

Electrical work and live working divides on one question: is the equipment dead or live. Work on equipment made dead and proved dead is ordinary work protected by an isolation regime, usually authorised through an isolation or electrical safety document recording what was isolated, by whom, and how absence of voltage was proved. Working live means deliberately placing a person in contact with or close to energised conductors, where the hazards are shock, arc flash and the secondary injuries that follow an involuntary reaction. Because the primary control, removing the energy, has been set aside, everything else carries the load, which is why live working attracts a much heavier authorisation burden: higher level sign off, a documented justification that the work cannot reasonably be done dead, specific rather than general competence, and usually a named individual accountable rather than a role. In United States federal jurisdiction the control of hazardous energy generally is 29 CFR 1910.147, "The control of hazardous energy (lockout/tagout)", Subpart J, and some State Plan states have their own instrument, for example California at 8 CCR 3314; the widely used consensus document there is NFPA 70E, "Standard for Electrical Safety in the Workplace", currently the 2027 edition, developed at OSHA's request but not itself an OSHA regulation. Commonly got wrong: assuming a lockout satisfies the permit and a permit satisfies the lockout. See LOTO versus permit to work and the lockout tagout guide.

Line breaking covers deliberately opening a pipe, vessel, duct or system that has held a hazardous substance: cracking a flange, removing a valve, cutting into a line, opening a manway. The hazard is residual content. A system shut down, drained and reported empty is frequently not empty: liquid sits in low points, gas in high points, sludge and scale hold contaminant, a dead leg holds whatever was in it last, and pressure can be trapped between two closed valves with nothing outside to indicate it. What comes out when the joint parts is what injures people, at the moment of least control, when hands are on the fitting. What makes this distinct is that the isolation and the emptying are the work as far as the permit is concerned, and they are what gets compressed when a shutdown runs late. Commonly got wrong: relying on a closed valve rather than positive separation. In Great Britain, substances hazardous to health are additionally governed by COSHH 2002 (as amended), SI 2002/2677, and explosive atmospheres by DSEAR 2002 (as amended), SI 2002/2776. Elsewhere, equivalent specific instruments apply.

Pressure systems and pressure testing are related but not the same. Line breaking concerns what a system held; testing concerns the energy you are deliberately putting into it. The hazard is stored energy released suddenly through the failure the test exists to find, which makes the test the moment the system is most likely to fail and the people nearby most exposed. The controlling principle is therefore exclusion, and the boundary of the excluded area is a judgement for someone competent to assess what a failure would do, not a number lifted from another site's procedure. Pressure equipment is governed by specific legislation and inspection regimes in most jurisdictions, often with a statutory examination scheme attached. Work from yours. Commonly got wrong: treating a pneumatic test as a milder hydraulic one, when the compressibility of gas is what makes a pneumatic failure more energetic.

4. Work at height, roof access and excavation

Work at height covers work where a person could fall a distance liable to cause injury. Three hazards travel together: the fall, the access equipment used to reach the position, and dropped objects endangering people below. The third is most often left out and it is a real killer, because a tool released from height is a projectile and the people it lands on have no reason to look up. What makes this awkward as a permit category is that many sites do not treat it as one. The activity is so common that permitting it would mean issuing permits continuously, so organisations often control it through a method statement plus an access authorisation for the equipment, escalating to a permit only for defined circumstances such as work on or near a fragile surface, work over water or plant, or work relying on fall arrest rather than fall prevention. That is a legitimate design choice provided the escalation criteria are written down. In Great Britain the governing instrument is the Work at Height Regulations 2005 (SI 2005/735), amended by SI 2007/114; in United States federal jurisdiction, construction fall protection is 29 CFR 1926 Subpart M, sections 1926.500 to 1926.503. Commonly got wrong: authorising the person and forgetting the equipment, or the reverse. Detail in working at height hazards and controls.

Roof access is frequently separated out, for a good reason: the hazard is the structure rather than the task. Someone can be on a roof doing nothing more hazardous than reading a gauge and still be at serious risk, because the surface may be fragile, the edge unprotected, the anchors unverified or absent, and roof plant may be discharging heat, exhaust or noise. Separating it authorises presence rather than activity, and it gives the site a register of who is up there, which matters when the roof carries live plant somebody else may be about to start. Commonly got wrong: permitting the trade that owns the plant and leaving surveyors, aerial installers, window cleaners and inspectors outside the system.

Excavation and ground disturbance covers any breaking of ground: trenching, piling, coring a slab, driving a stake, augering. Three hazards justify it. Buried services, where striking a live cable, gas main, water main or fibre route injures the operative and can take out something far larger than the job. Collapse, because unsupported ground even at modest depth can bury a person faster than anyone can reach them. And access, both people falling in and plant working at the edge. What makes it distinct is that the substance of the control is identification, not digging: drawings, service records, scanning and trial holes are what the permit is actually about. The honest position is that the record is never complete, because services get installed unrecorded, recorded wrongly, or moved, so a survey narrows uncertainty rather than eliminating it. Commonly got wrong: treating a services drawing as authoritative because it exists. In Great Britain construction work additionally engages CDM 2015 (SI 2015/51).

5. Lifting operations and plant entry

Lifting operations covers cranes, hoists, gantries and lifting accessories moving a load. Three things carry the hazard: the plan, because most lifting incidents are planning failures rather than equipment failures; the load path, because what the load travels over determines who is exposed; and the exclusion of people from where a dropped or swinging load would land. The distinctive feature is that the risk is dynamic. Almost every other category here controls a static situation with a boundary you can draw and walk away from. A lift moves, and the exposed population changes as it does. Many sites issue no lifting permit at all; they use a lift plan signed by an appointed person, which is the same function under a different name. In Great Britain lifting is governed by LOLER 1998, the Lifting Operations and Lifting Equipment Regulations 1998 (SI 1998/2307), with work equipment generally under PUWER 1998 (SI 1998/2306); those SI numbers are consecutive and get transposed constantly, and there is no LOLER 1992. Commonly got wrong: planning the lift and not the exclusion.

Vehicle and plant entry is a catch all category controlling the movement of vehicles or mobile plant into an area where their presence is itself the hazard: a hazardous area where an engine is an ignition source, a live process area, an occupied building, an area with load limited floors or restricted headroom, or a pedestrian zone. It authorises the machine and its operator into a defined area rather than a task, and it exists mainly so the people already there know something large is coming. Commonly got wrong: issuing it for contractors and exempting the site's own plant, which is usually the plant in that area most often.

6. Radiation work and hazardous substances

Radiography and radiation work covers industrial radiography, sealed sources, and any work bringing ionising radiation into a workplace. The controlling principle is exclusion and notification: keeping people out of an area they cannot see a hazard in, and making sure everyone who might walk into it knows not to. The hazard is invisible, gives no sensory warning, and the people at risk are often not the crew but whoever is on the other side of a wall the radiographer believed was unoccupied. That is also why radiography so often runs at night on operating plant, and why the permit interacts with everything else live at the time. Ionising radiation is subject to specialist legal regimes almost everywhere, typically involving notification or licensing, formal radiation protection advice, dose monitoring and designated area classifications. Those are jurisdiction specific and I am not going to paraphrase them.

Hazardous substances and asbestos adjacent work is where a general article should be most careful. Work disturbing asbestos containing materials, lead, silica, biological agents or other substances with a specific regime attached is governed by specific legislation and formal competence and licensing arrangements in most jurisdictions, and those differ substantially between countries in what they require, who may do the work, what notification is needed and what happens to the waste. I am not going to state requirements for it. What is useful at the catalogue level is why it is separated at all: the hazard is created by disturbance rather than by the task, the exposure often reaches people other than the operative, and the health effect is latent, so nothing at the time tells anyone it went wrong. In Great Britain the general substances regime is COSHH 2002 (as amended), SI 2002/2677, with specific domains carrying their own instruments on top. Work from your own jurisdiction's legislation. Commonly got wrong: unplanned disturbance during unrelated work, which is why a permit for intrusive work into building fabric is a sensible control.

7. Work affecting fire and life safety systems

This category is missing from most published permit type lists and it should not be. It covers work that takes fire detection, suppression, alarm, smoke control or emergency lighting out of service, whether deliberately as an isolation or incidentally as a consequence of other work. The hazard is not in the task. The hazard is that the building's protection has been removed and the people occupying it do not know. It deserves a category because the exposure profile is unlike anything else here. Every other permit protects a small, identified group doing a known task. An impairment exposes everyone in the building for as long as it lasts, and the harm only materialises if something unrelated goes wrong during that window. Wide exposure plus conditional harm is the combination organisations systematically underweight. The authorisation therefore does two jobs: permitting the isolation, and requiring compensatory arrangements to stand in for the protection removed while it is down, with a positive restoration step so the system is proved back in service rather than assumed.

The other reason it earns a place is interaction. Impairment is the category most likely to collide with hot work, which is uncomfortable, because hot work is the activity most likely to require detection to be isolated to avoid nuisance alarms and simultaneously the activity for which working detection matters most. A site that cannot see both permits against each other has a real problem. Relevant United States consensus documents include NFPA 72, "National Fire Alarm and Signaling Code", currently the 2025 edition, for detection and alarm, and NFPA 25, "Standard for the Inspection, Testing, and Maintenance of Water-Based Fire Protection Systems", currently the 2026 edition, for water based suppression; NFPA 13 covers installation of sprinkler systems rather than their inspection and maintenance, and the two are confused constantly. These are not law in themselves, and the edition your authority having jurisdiction adopted is what applies. See elevator, fire and life safety system PM. Commonly got wrong: the restoration. An impairment raised on a Friday and forgotten over a weekend is a common serious audit finding.

8. Cold work and general work permits

The catch all category, and more useful than its vagueness suggests. A cold work or general work permit covers work carrying no ignition source and no single dominant specialist hazard, but still needing authorisation because of where it is or who else is affected: mechanical work on plant in a live process area, instrument work, cleaning inside an operating unit, contractor activity in an occupied building. Its function is coordination rather than hazard specific control. It puts the work on the register, tells the area owner it is happening, and creates a point at which somebody with local knowledge can say "not while that other thing is running". On process sites it is often the highest volume permit, and that volume is the design tension: a general permit easy to issue gets issued for everything and stops meaning anything, while one that is hard to issue gets bypassed. Commonly got wrong: using it as the default because choosing the right category takes thought, so a job needing a confined space or line breaking authorisation runs on a general permit instead.

9. The catalogue at a glance

A summary, with the caveat that the left hand column is not a list to adopt.

10. When one job needs several permits

The cross cutting point the list format hides: a single job routinely needs several permits at once. Welding a repair inside a tank is a confined space entry, a hot work activity, an isolation, and quite possibly a detection impairment, all on the same job at the same time in the same space. On an operating plant that is a normal Tuesday, not an edge case.

The coordination problem it creates is a hazard in its own right, and I would name it as one. Controls conflict, because the ventilation that makes an atmosphere breathable is also airflow that can carry a spark somewhere unhelpful. Sequencing breaks, because permits are issued at different times by different authorisers and one can be valid while a precondition on another has lapsed. Handback becomes ambiguous, because a crew that finishes welding and leaves has not necessarily ended the entry or restored the detection. And responsibility disperses, because each authoriser signed for their own hazard and nobody signed for the interaction.

The only real answer is that somebody holds the whole picture. Sectors name that person differently and the mechanism varies: a single controlling permit the others hang from, a permit coordinator role, a daily control of work meeting reviewing all live permits against each other, or a register displaying concurrent permits by location. What matters is not which mechanism but that one exists and the interaction has an owner. A system where every permit is correctly completed and nobody can see them together will eventually be surprised. That is also the argument for one register rather than several, whether paper or software, a question I have written about separately in the context of permit workflow inside a maintenance system.

11. How a site decides which permit types it needs

Start from your hazards and your legal obligations, not from somebody else's list. The sequence I would advise: inventory the activities that actually occur, including the ones done annually by contractors and the ones nobody counts as work; identify which carry a hazard that standing instruction, training and supervision cannot adequately control; check which of those carry a specific legal requirement in your jurisdiction, because those are not discretionary; and only then decide how many named categories the remainder needs. A list assembled the other way round, from a template, produces categories for hazards you do not have and silence on the ones you do.

There is a genuine trade off in how many categories to run, and both extremes fail. Too many and the clerical load becomes the dominant experience of the system: authorisers signing volume rather than reading, supervisors choosing whichever category is quickest to obtain, and the boundaries themselves becoming a source of confusion. Too few and interaction hazards go uncontrolled, because one broad permit cannot carry the different competence, notifications and verification that genuinely different hazards need, so the specialist hazard gets absorbed into a general authorisation where nobody looked for it.

One honest observation from configuring a lot of these systems: a permit category nobody present can explain the purpose of has usually outlived its reason. It was created for a process since decommissioned, a regulator that has changed position, or an incident predating everyone currently employed. It is not harmful in itself, but it consumes attention and teaches people that some permits are theatre, and that lesson does not stay confined to the obsolete category.

Where does the hierarchy of controls sit in this? A permit is an administrative control, so it sits low in the hierarchy as required by ISO 45001:2018 at clause 8.1.2, the certifiable occupational health and safety management system standard, as amended by Amd 1:2024, and by ANSI/ASSP Z10.0-2019 at section 8.4 in the United States. That placement is a reminder rather than a criticism: a permit category exists because a hazard could not be eliminated, substituted or engineered out, so a permit set is also a map of where a site has accepted an administrative control for want of anything better. Reading it that way occasionally reveals a category that should be an engineering project instead. The underlying discipline is ordinary risk assessment; see the risk assessment guide and, for the wider frame, what HSE actually covers.

12. The naming problem: permit, certificate, clearance or plan

The same control appears under different names depending on employer, sector and country. What one site calls a hot work permit another calls a hot work certificate. An isolation is a permit here, a safety document there, a clearance somewhere else. A lift is governed by a permit at one company and a lift plan at the next. Some of the variation is meaningful. In several sectors "permit" and "certificate" carry a real distinction, where a certificate records a state of affairs established by a competent person, for example that an isolation has been applied or a space tested, and a permit authorises work in reliance on those certificates. That is a sound structure and worth recognising when you meet it. Much of the rest is vocabulary inherited from whoever wrote the system, and treating it as significant leads people to conclude another site has a gap when it simply has a different word.

So match on function, not vocabulary. For any control you encounter, ask what it does: does it record a verified state, or authorise an activity? Who signs it, and what competence does that signature assert? What does it suspend or restore? Who is told? When does it end, and how is that end proved? Any document answering those questions is doing permit work whatever the letterhead calls it. That is also the fastest way to audit an unfamiliar system: ignore the names and check the functions.

The idea to walk away with

Permit types are not a taxonomy to memorise. Each category is an argument that a particular hazard needs a named authorisation gate in front of it, because it needs a different competence to judge, a different set of people informed, or a different verification before work begins. Read a permit list that way and it becomes informative: you can see what hazards the site believes it has, which of them its jurisdiction mandates a formal regime for, and occasionally which hazard it has forgotten. Read it as a list and you learn nothing except what somebody once typed. Three things follow. The set is local, so no published list is your list and the legally mandated domains differ by country in ways you must check rather than assume. The interactions matter more than the categories. And the categories nobody can justify are the ones to look at hardest, in both directions: the obsolete one that should go, and the missing one, very often fire and life safety impairment, that should have been there all along.

Final thoughts

This subject attracts list articles because a list looks like an answer. It is not. The hazards on a chemical plant, a hospital, a data centre and a construction site overlap only partially, the law differs by country and sometimes by emirate or state, and the permit set that is right for one is over-engineered for the second and dangerously thin for the third. Anyone offering a definitive list of permit types is describing their own experience, and so, honestly, is anyone offering a catalogue, including this one.

If you are reviewing a permit system, one productive exercise costs nothing. Take the site's list of categories and, for each, ask what hazard it controls and what would happen if it did not exist. The ones that answer confidently are your system; the ones that cannot are either obsolete or were never thought through. Then ask the harder question in the other direction, which hazards have no category at all, and check the fire and life safety impairment case specifically, because in practice that is the one most often absent. What you do next is a matter for a competent safety professional and your own jurisdiction's law, which is exactly where it should sit.

Related reading: Permit to work: the complete guide, Hot work permit requirements, Confined space permit guide, LOTO versus permit to work, Working at height, Risk assessment guide, Work order types in CMMS. External references: HSE , OSHA , NFPA , ISO .