Temporary Deviation Permit¶
Document — instantiates Workaround Governance
A time-limited written authorization specifying who may run a workaround, under what scope and safeguards, until when, and the conditions that force an immediate stop.
The most dangerous state a workaround can occupy is tacit tolerance — everyone knows it happens, no one has said it may, and no one owns what happens when it goes wrong. A Temporary Deviation Permit is the document that replaces that fog with an explicit, bounded, accountable "yes, for now." Its defining feature is the envelope: a written authorization that names exactly who may use the deviation, over what scope, with which owner, until what expiry, and — critically — which compensating safeguards must be in place while it runs and which stop conditions end it immediately. Authorization is not endorsement; the permit says the practice is governed for a bounded period, not that it is good. It converts an ambiguous known deviation into a signed, time-boxed, safeguard-conditioned exception that someone is accountable for and that expires on its own.
Example¶
During a pre-flight check, a line-maintenance crew finds one of a jet's two cabin-pressure indication channels reading intermittently. Grounding the aircraft would cancel a full flight; ignoring it is unthinkable. The airline issues a Temporary Deviation Permit against its deferred-defect process: the aircraft may fly with this specific fault, but the permit's envelope is precise. Scope: this tail number, this fault, cabin altitude below a stated ceiling, day operations only. Compensating safeguards: the remaining channel is cross-checked at defined intervals, the crew is briefed, and a manual altitude callout procedure is armed as backup. Owner: the duty maintenance controller, named on the permit. Expiry: ten calendar days or the next scheduled maintenance visit, whichever comes first. Stop condition: any anomaly on the remaining channel grounds the aircraft immediately. The permit does not repair the sensor and does not decide the sensor's long-term fate — it authorizes a bounded, safeguarded continuation so operations survive without pretending the fault away, and it expires by itself so "temporary" cannot silently become permanent.
How it works¶
- Write the envelope explicitly. The permit states scope (who, what, where, which conditions), owner, and expiry — the ambiguity the deviation used to live in is replaced by named boundaries.
- Attach the compensating safeguards. The authorization is conditional: specific controls must be in place while the deviation runs, so the risk it introduces is actively offset rather than accepted bare.
- Define hard stop conditions. Named triggers end the permit at once — an incident, a threshold breach, a scope violation — separating "bounded risk" from "open-ended risk."
- Time-box with a real expiry. The permit lapses on a date or event; continuation past that point requires a fresh, evidenced authorization, not silent drift.
- Record for accountability. The permit is a signed artifact naming the authorizer and owner, so the interim state is auditable and answerable rather than tacit.
Tuning parameters¶
- Scope width — one person/tail/case versus a role or fleet. Narrow scope contains exposure but multiplies paperwork and can create inequity; broad scope is consistent but riskier.
- Expiry force — hard automatic lapse versus renew-by-default. Hard expiry prevents permanent temporariness but risks a cliff if the replacement is late; renewal-by-default softens the cliff but breeds permanent exceptions.
- Safeguard stringency — how heavy the compensating controls are. Heavier controls lower residual risk but raise the burden of running the deviation at all.
- Stop-condition sensitivity — how twitchy the immediate-halt triggers are. Sensitive stops bound risk tightly but cause disruptive false halts; loose stops risk running past real danger.
- Approval level — local sign-off versus independent authorization. Independent approval suits high-risk deviations but slows issuance when speed is the whole point.
When it helps, and when it misleads¶
Its strength is that it destroys tacit tolerance — the single most dangerous ungoverned state — by forcing scope, owner, safeguards, expiry, and stop rules onto the page, so a necessary continuation is accountable and bounded rather than a shared open secret. It buys time for repair without normalizing the deviation.
Its central failure mode is the permit that never expires: renewed by default, cycle after cycle, until the "temporary" exception is a permanent feature that no one revisits and the compensating safeguards quietly lapse. Aviation's Minimum Equipment List[n1] is the disciplined counter-model — a deferred item carries a hard repair interval and defined conditions precisely so deferral cannot drift into permanence. The classic misuse is issuing a permit and treating the expiry as advisory. The guarding discipline is a real expiry with staged warnings, evidence required for any renewal, and a periodic reauthorization checkpoint — a scheduled reckoning distinct from this per-case document, of the kind run by Sunset and Reauthorization Review — so continuation is always an active decision, never a default.
How it implements the components¶
This document fills the interim-authorization side of governance — the accountable "yes, for now":
provisional_authorization_envelope— the permit is the envelope: a written, time-boxed grant naming users, scope, owner, expiry, and stop triggers, turning tacit tolerance into an explicit accountable state.compensating_safeguard_plan— the permit makes authorization conditional on named compensating controls that offset the deviation's added risk for the duration it runs.
It does not repair the underlying source condition (formal_system_repair_link — that is Linked Root-Cause Repair Ticket), nor watch for recurrence and displacement after issuance (recurrence_and_displacement_monitor — that is Recurrence and Displacement Dashboard).
Related¶
- Instantiates: Workaround Governance — this document enacts the "temporary continuation must be explicit" invariant.
- Consumes: Workaround Failure-Mode and Effects Review — supplies the failure modes the permit's compensating safeguards are designed to catch.
- Sibling mechanisms: Sunset and Reauthorization Review · Linked Root-Cause Repair Ticket · Recurrence and Displacement Dashboard · Multi-Path Disposition Matrix · Nonpunitive Workaround Review · Practitioner Counterfactual Walkthrough · Benefit-Preserving Transition Plan · Structured Workaround Registry · Workaround Failure-Mode and Effects Review
Editorial Notes¶
Form Classification¶
Form family: Rule, Policy & Commitment
Rationale: Temporary Deviation Permit operates as a standing rule, threshold, contractual commitment, or policy constraint governing future conduct because it a time-limited written authorization specifying who may run a workaround, under what scope and safeguards, until when, and the conditions that force an immediate stop.
Independent corroboration: The frozen evidence defines Temporary Deviation Permit as 'A time-limited written authorization specifying who may run a workaround, under what scope and safeguards, until when, and the conditions that force an immediate stop', so its operative form is Rule, Policy & Commitment.
Nearest alternative: Decision, Gate & Allocation — Temporary Deviation Permit includes features of a case-specific gate, selection, routing, prioritization, or resource disposition, but its defining operation is a standing rule, threshold, contractual commitment, or policy constraint governing future conduct.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Law & Governance
Origin pattern: Single lineage
Present-day reach: Universal
Rationale: The defining operation is: A time-limited written authorization specifying who may run a workaround, under what scope and safeguards, until when, and the conditions that force an immediate stop. In the law_governance lineage, that operation is specifically evidenced by authoritative or primary work that uses defined scope, effective periods, expiration, renewal, and legislative approval to keep extraordinary authority temporary. This makes law_governance the best historical origin, while the retained alternates document contributing methods and later applications rather than being mistaken for coequal origins.
Related originating lineages:
- Engineering & Design — Engineering design, reliability, and systems-safety practice supplies a parallel or contributing lineage for the mechanism's defining operation: a time-limited written authorization specifying who may run a workaround, under what scope and safeguards, until when, and the conditions that force an immediate stop.
- Organizational & Management Science — Organizational design, management, and operational governance supplies a parallel or contributing lineage for the mechanism's defining operation: a time-limited written authorization specifying who may run a workaround, under what scope and safeguards, until when, and the conditions that force an immediate stop.
- Public Administration & Policy — Public administration, policy implementation, and program oversight supplies a parallel or contributing lineage for the mechanism's defining operation: a time-limited written authorization specifying who may run a workaround, under what scope and safeguards, until when, and the conditions that force an immediate stop.
- Systems Thinking & Cybernetics — Systems science's feedback, stock-flow, boundary, and regulation tradition provides a formative adjacent lineage for the same temporary deviation permit operation.
Review resolution: The blind reviewers disagree on primary lineage (organizational_management versus law_governance), so I adjudicated the mechanism rather than inheriting either label. The defining operation is: A time-limited written authorization specifying who may run a workaround, under what scope and safeguards, until when, and the conditions that force an immediate stop. In the law_governance lineage, that operation is specifically evidenced by authoritative or primary work that uses defined scope, effective periods, expiration, renewal, and legislative approval to keep extraordinary authority temporary. This makes law_governance the best historical origin, while the retained alternates document contributing methods and later applications rather than being mistaken for coequal origins. The cited Congressional report on temporary emergency authority directly supports the mechanism-specific operation and its disciplinary lineage. I retain all independently explained historical alternates without a numeric cap. origin_mode=single_lineage records how the mechanism arose; domain_reach=universal separately records how broadly it can now be applied.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
Notes¶
The permit is a per-case document that grants a bounded continuation; Sunset and Reauthorization Review — a mechanism developed under a different archetype — is a periodic terminal checkpoint that re-tests whether a standing arrangement should be renewed at all. They compose naturally: the permit sets an expiry; the reauthorization review is the disciplined moment at which continuing must be actively re-earned rather than assumed.
[n1] Minimum Equipment List (MEL) — an aviation document authorizing an aircraft to operate with specific equipment inoperative, under defined conditions, procedures, and a hard time limit for repair. It is a mature model of a temporary deviation permit: continuation is explicit, safeguarded, and bounded by a repair interval so deferral cannot silently become permanent. ↩