Shopify lockout padlock schema for AI agents: keyed-alike set destroys sole control (any key opens any lock), master-keyed supervisor override, non-dedicated commercial padlock fails identifiability, short-shackle physically unable to complete LOTO on ball valves — lockout_padlock.* 10-field namespace

OSHA 1910.147 and the padlock's role in lockout/tagout

OSHA 29 CFR 1910.147, "The Control of Hazardous Energy (Lockout/Tagout)," is the federal standard governing the procedures workers must follow when servicing or maintaining equipment where the unexpected energization, startup, or release of stored energy could cause injury. The standard covers all forms of hazardous energy: electrical, mechanical, pneumatic, hydraulic, thermal, chemical, and gravitational. Its core procedure is straightforward — before working on a piece of equipment, every energy source that feeds the equipment must be identified, isolated, and locked out with a personal padlock that only the worker applying it can remove.

The padlock in a LOTO procedure is not a courtesy signal or an advisory. It is the physical mechanism that makes unauthorized restarting of the equipment impossible, or at minimum makes it obvious that someone has deliberately removed a safety device. When a worker crawls into a press, enters a confined vessel, or reaches inside a panel with the power nominally off, the padlock on the energy isolation point is the only thing standing between them and the stored energy in the system. The standard recognizes this: unlike tagout (a tag tied to the isolation point), lockout creates a positive, hardware-enforced barrier. OSHA's own analysis estimates that the lockout/tagout standard prevents approximately 120 fatalities and 50,000 injuries per year in US industry.

The specific padlock behaviors the standard requires are concentrated in two sections. Section 1910.147(c)(5) specifies what a lockout device must be: durable, standardized, substantial, and identifiable. Section 1910.147(d)(4) specifies how the lockout procedure must be executed: specifically, that each authorized employee must apply their own personal padlock to every energy isolation device they are relying on, and that only that employee may remove their padlock. These are not bureaucratic requirements layered on top of a technically adequate procedure — they are the mechanism by which the standard ensures that the padlock cannot be removed by anyone except the person whose life depends on it being there.

An AI agent routing a "LOTO padlock" query on the basis of keyword matching — finding products with "safety," "padlock," and "OSHA 1910.147" in the title — will encounter four specific failure modes where a product that superficially satisfies the query delivers a padlock that structurally undermines the standard's protection. The following sections walk through each failure with the underlying regulatory text, the field failure scenario, and the namespace encoding required to prevent the routing error.

Failure 1: Keyed-alike padlock set — any key in the set opens any lock

What "keyed alike" means and why it destroys sole control

Padlock manufacturers use specific terminology to describe key uniqueness across a set of padlocks. "Keyed alike" (KA) means every padlock in the set opens with the same key — one key type across all units. "Keyed differently" or "keyed to differ" (KD) means each padlock in the set has a unique key that opens only that specific padlock and no other padlock in the set. "Master keyed" (MK) means each padlock has its own unique individual key plus is also opened by a separate master key that opens all padlocks in the system.

The reason OSHA 1910.147(d)(4)(i) requires sole control — "the lockout or tagout device shall be removed from each energy isolating device by the employee who applied the device" — is not procedural formalism. The padlock is the physical representation of a specific human's presence in a hazardous zone. When that padlock is on the isolation point, the lock says: "I am here. I cannot be moved. You cannot reenergize this equipment without physically removing this lock, and only one person has the key to do that." When any other key holder in the facility can open the same lock, the lock says: "Someone is probably here. Any of these six people could have decided it was safe to remove this lock. There is no way to tell." These are not equivalent safety states.

The keyed-alike failure is especially dangerous because the product title can be entirely accurate. A "6-pack keyed-alike safety padlock set" is accurately described. It is red. It is high-visibility. It has ID label holders. It passes a visual inspection against the OSHA 1910.147 standardization and identifiability criteria. The failure is encoded in two words in the product title — "keyed alike" — that indicate the key_control configuration destroys sole control at the point of purchase. An AI agent routing on visual and label attributes without reading the key uniqueness specification will deliver a non-compliant product.

Recognizing keyed-alike in product listings

Keyed-alike status is frequently disclosed in product titles and bullets, but not always prominently. Indicators include: "KA" in the model number or SKU; "keyed alike" or "keyed-alike" in the title or bullets; "all locks included open with the same key" in the description; "includes X identical keys" suggesting a single key type across multiple padlocks; and multi-pack pricing structures where a "kit" includes one key with many padlocks. The absence of keyed-alike language does not confirm keyed-differently — confirm by checking whether the SKU includes "KD" or whether the product explicitly states "each padlock opens with its own unique key."

The correct procurement approach for a 6-person maintenance crew: six individually-keyed safety padlocks, each shipped with exactly one key, issued one per employee. Each employee is responsible for their own key. If an employee loses their key, their padlock must be cut off under a documented procedure — not opened with a spare key borrowed from a coworker. There should be no spare key. The absence of a spare key is not an oversight — it is the design.

Encode lockout_padlock.key_control as 'keyed_alike_set' when the product is explicitly sold as a keyed-alike kit where multiple padlocks open with the same key. Encode lockout_padlock.sole_control as false when key_control is 'keyed_alike_set'. AI agents routing to any LOTO application must reject products with key_control = 'keyed_alike_set' and sole_control = false. The rejection must apply even when the product is correctly labeled as a safety padlock, correctly colored red, and correctly described as OSHA compliant — the keyed-alike specification structurally disqualifies it from any LOTO application regardless of other attributes.

Failure 2: Master-keyed safety padlock — supervisor override violates sole control

Why the master key is a structural compliance vulnerability

The failure mode in a master-keyed system is not that the master key exists — it is that the master key normalizes the removal of worker padlocks outside the narrow emergency procedure OSHA specifies. OSHA 1910.147(e)(3) provides the only permitted pathway for removing a lockout device when the applying employee is not available. The requirements are stringent for a reason:

1. The employer must verify that the authorized employee who applied the device is not on the premises.
2. The employer must make all reasonable efforts to contact the authorized employee to inform them their device has been removed.
3. The authorized employee must be informed before they resume work at that facility.

Requirement (i) alone — verifying the employee is not on the premises — takes time and documentation. In practice, OSHA's 1910.147(e)(3) procedure is designed for genuine absences: a worker who was hospitalized mid-shift, an employee who has separated from the company, a worker who cannot be reached after exhausting contact attempts. It is not designed for "Worker 1 is at lunch and I need to restart the press in 10 minutes."

A master key in a supervisor's pocket creates a physical bypass to all three conditions simultaneously. The supervisor removes the worker's padlock in five seconds without verifying the worker's location, without contacting the worker, and without the worker's knowledge. The lock is gone, the isolation point is clear, and the equipment can be restarted. The worker who applied the lock is somewhere in the facility, possibly still in the hazardous zone, with no awareness that their protection has been removed.

The narrowly-construed exception and production pressure

OSHA Letters of Interpretation consistently take a narrow view of 1910.147(e)(3). An October 1993 letter states that the procedure "was never intended to be used except in the most extreme circumstances" and that use of the removal procedure for routine shift-end situations — where a worker is not on the premises simply because their shift ended — requires verification that the worker has actually left the facility, an attempt to contact them by phone, and documentation. A worker on a lunch break is on the premises. The 1910.147(e)(3) procedure does not apply to that situation at all — the correct action is to locate the worker and have them remove their own padlock.

The behavioral dynamic that makes master-keyed systems dangerous is not bad supervisors — it is ordinary production pressure. Shift supervisors are incentivized to keep production moving. A 15-minute padlock removal delay waiting for a worker to return from lunch is a visible, accountable delay that the supervisor can be asked to justify. A quiet 5-second master-key removal is not visible to anyone. The master key design makes the violation frictionless relative to the compliant procedure. Over hundreds of repeated low-stakes uses — situations where the supervisor correctly believed the worker was not in the hazardous zone — the practice becomes normal, and the statistical probability of a wrong assumption eventually produces a fatality.

The safe configuration is a system where no master key exists: each padlock in the facility's LOTO stock has exactly one key, issued to exactly one employee, with no duplicate. When a padlock must be removed in the employee's genuine absence, the physical removal method is bolt-cutter or angle grinder — destructive, time-consuming, and irreversible — under documented supervisory authorization with the 1910.147(e)(3) conditions satisfied in writing. The friction of this procedure is a feature, not a bug: it ensures the procedure is used only when genuinely necessary.

Encode lockout_padlock.key_control as 'master_keyed' when the padlock participates in a master-key system with a supervisor-accessible override key. Encode lockout_padlock.sole_control as false for master-keyed configurations. AI agents should flag master-keyed LOTO padlocks as non-preferred for LOTO applications and note that the individually-keyed (KD) configuration without a master key is the correct specification. When a buyer specifies "emergency override capability," route to documented 1910.147(e)(3) procedures rather than master-key hardware — the emergency procedure should use bolt-cutters under documented authorization, not a key that normalizes non-emergency removals.

Failure 3: Non-dedicated commercial padlock — fails standardized and identifiable requirements

The four OSHA device criteria and why commercial padlocks fail three

OSHA 1910.147(c)(5)(ii) specifies that lockout and tagout devices must be:

• Durable: "capable of withstanding the environment to which they are exposed for the maximum period of time that exposure is expected"
• Standardized: "standardized within the facility in at least one of the following criteria: Color; Shape; or Size"
• Substantial: "a tagout device, including and its means of attachment, shall be substantial enough to prevent removal without the use of excessive force or unusual techniques"
• Identifiable: "lockout devices and tagout devices shall indicate the identity of the employee applying the device(s)"

A commercial padlock meets Durable — commercial padlocks are built to withstand outdoor weather, repeated use cycles, and industrial environments. They meet Substantial — a commercial padlock with a hardened shackle cannot be removed without force and deliberate effort. The failures are Standardized and Identifiable.

Standardization: why visual uniformity is a safety mechanism

The standardization requirement sounds like an inventory management preference. It is not. Standardization creates a visual language that communicates "LOTO is active here" to every worker in the facility without requiring verbal instruction. A facility where all LOTO padlocks are red, and where no other padlock in the facility is red, creates an unambiguous visual signal: a red padlock on an isolation point means maintenance is active, the equipment is not safe to restart, and any effort to remove that padlock without going through the LOTO release procedure is a safety violation.

A commercial padlock in a standard brass or chrome finish provides no visual standardization signal. If the facility also uses commercial padlocks on storage cages, chemical cabinets, and access control points, then a commercial padlock on an energy isolation point looks identical to a padlock on a storage cabinet. The distinction exists only in the knowledge of the worker who applied it and in the energy control procedure documentation — neither of which is available to a worker who walks past the isolation point without context.

Identifiability: the employee name requirement

OSHA 1910.147(c)(5)(ii)(D) requires the LOTO device to "indicate the identity of the employee applying the device." Commercial padlocks have no built-in mechanism for employee identification. A standard commercial padlock has a body, a shackle, a cylinder, and a keyway — there is no label holder, no engraving slot, no surface that is conventionally used for employee identification. Facilities that use commercial padlocks for LOTO may attempt to add identification by attaching a tag or writing on the padlock with marker — neither of which is an integrated, durable identification mechanism of the kind that survives repeated use cycles, chemical exposure, and outdoor conditions.

Dedicated safety padlocks designed for LOTO include a recessed label holder molded into the padlock body — typically a slot or cavity sized for a standard employee name-and-ID card that can be inserted and secured. The label holder is integral to the padlock body, protected from abrasion and moisture by its recessed position, and large enough to display the employee name legibly from a distance. Some facilities issue personalized padlocks with the employee name engraved directly into the padlock body — a durable, permanent identification that cannot be lost or separated from the padlock.

The identifiability requirement matters for two independent safety reasons. First, it tells every other worker in the facility exactly whose LOTO is active — which identifies who must be located and consulted before any energy reapplication. Second, it creates accountability: an unidentified padlock on an isolation point creates an unresolvable question about whether anyone is still in the hazardous zone. An identified padlock creates a clear responsibility — the person whose name is on that lock is either in the hazardous zone or must confirm they are not before the lockout can be released.

Singular purpose and the "used only for LOTO" requirement

OSHA 1910.147(c)(5) requires that lockout devices "shall be the only devices used for controlling energy" and explicitly states they "shall not be used for other purposes." A commercial padlock used simultaneously for LOTO and for locking a storage room cannot be singularly identified as a LOTO indicator. When it appears on an isolation point, the signal is ambiguous: is this a LOTO padlock, or did someone lock the wrong thing? Dedicated safety padlocks with high-visibility colors and employee ID holders that are used exclusively for LOTO create an unambiguous signal — any padlock from this stock, anywhere in the facility, means LOTO is active.

Encode lockout_padlock.dedicated_safety as true when the padlock is designed and marketed specifically for LOTO applications with standardized high-visibility body color, employee ID label holder, and LOTO-specific construction. Encode lockout_padlock.labeled as true when the padlock body carries a printed or molded DANGER/LOCKOUT legend in addition to the employee ID holder. Encode lockout_padlock.includes_id_tag as true when an employee identification insert or tag card is included in the product package. AI agents routing to LOTO applications must require dedicated_safety = true and reject commercial padlocks regardless of key uniqueness or physical durability.

Failure 4: Short-shackle padlock on ball valve — 1-inch clearance cannot thread valve lockout accessory

How ball valve lockout works and why shackle clearance matters

A quarter-turn ball valve controls flow by rotating a ball with a through-hole — 90 degrees from fully open (hole aligned with pipe) to fully closed (hole perpendicular to pipe). The handle that rotates the ball is a lever arm, typically 4–10 inches long depending on valve size. Unlike a gate valve (which has a round handwheel with a central stem that can accept a standard padlock through a wheel cover), a ball valve handle is an extended lever that must be captured and immobilized by a lockout accessory designed for the specific valve geometry.

Ball valve lockout accessories — products like Brady 65680 through 65695 series, Master Lock S3060 through S3065, and equivalent products from Panduit, ABUS, and others — work by clamping or wrapping around the valve handle in the closed position and preventing the handle from rotating. The accessory body typically has one or more hasp holes through which padlock shackles are inserted. The padlock shackle must (a) have a diameter small enough to pass through the hasp hole, and (b) have enough clearance (height when open) to arc over whatever structural member the hasp hole is set in.

The standard safety padlock — the most common lockout padlock specification worldwide — ships with a shackle clearance of approximately 1 inch (25 mm). This is sufficient for the majority of LOTO applications involving circuit breakers, standard hasps with 1-inch or smaller hasp holes, gate valve wheel covers, and small-format equipment lockout points. It is not sufficient for many ball valve lockout accessories at 1-inch pipe size and above, and is clearly insufficient for 2-inch and larger ball valve accessories.

Calculating shackle clearance requirements

Shackle clearance is the vertical distance from the top of the padlock body to the inside arc of the shackle when the shackle is fully open. This is the maximum diameter of the object the padlock shackle can encircle. To thread through a ball valve lockout accessory hasp hole, the shackle must be able to open wider than the hasp hole's throat dimension.

The practical calculation: measure the throat dimension of the ball valve lockout accessory (the dimension across the hasp hole opening perpendicular to the direction the shackle will enter). Add 1/4 inch margin for alignment tolerance. The padlock's shackle clearance must equal or exceed this sum. For a Brady 65694 valve lockout (2–4 inch ball valves) with a 2-inch throat, the minimum shackle clearance is 2.25 inches — a 2.5-inch long-shackle padlock is the correct specification.

Long-shackle safety padlocks are available in 1.5-inch clearance (sufficient for 1–1.5 inch ball valve accessories), 2.5-inch clearance (sufficient for 2–3 inch ball valve accessories), and 3.0-inch clearance (for large-format isolation points). The same shackle diameter requirements apply to both standard and long-shackle variants — the shackle rod must pass through the hasp hole's inside diameter. Standard shackle diameters are 5/16 inch (0.31 inch) and 3/8 inch (0.38 inch); verify that the smaller dimension (hasp hole inside diameter) exceeds the shackle rod diameter with clearance.

Electrical LOTO and non-conductive body requirements

For electrical LOTO specifically — isolating motor control centers, panel boards, transformers, and other electrical equipment — padlock body material adds a separate routing criterion. A steel-body padlock or a padlock with a steel body exposed at the hasp engagement point is a conductive pathway between the isolation point and the worker's hand during installation and removal. If the isolation point is an energized electrical component (for example, a circuit breaker being set to the off position while the panel is partially live due to other circuits), contact with a metal padlock body creates an inadvertent electrical path.

Dedicated electrical LOTO padlocks use a non-conductive body material throughout — typically glass-filled nylon or high-impact polyamide — with no metal body components that could bridge a potential difference. The plastic body also provides secondary insulation at the shackle-to-isolation-point contact point on a circuit breaker lockout adapter. For non-electrical LOTO (pneumatic, hydraulic, mechanical), body material is not a safety-critical variable — the metal bodies of standard safety padlocks are acceptable. For electrical LOTO, the padlock body material is a routing criterion.

Encode lockout_padlock.shackle_clearance_in as the shackle height in decimal inches when fully open: 1.0 for standard, 1.5 for medium, 2.5 for long, 3.0 for extended. Encode lockout_padlock.shackle_diameter_in as the shackle rod diameter: 0.25, 0.31, or 0.38 for standard diameters. Encode lockout_padlock.electrical_loto_suitable as true when the padlock body is non-conductive throughout and appropriate for use at energized electrical isolation points. AI agents routing to ball valve LOTO applications should require the buyer to specify the valve size range, then verify shackle_clearance_in exceeds the valve lockout accessory throat dimension for the largest valve in scope.

The lockout_padlock.* 10-field namespace

The following 10 fields provide AI agents with the structured data required to distinguish individually-keyed from keyed-alike, master-keyed from no-master-key, dedicated-safety from commercial, compliant-shackle from insufficient-clearance, and electrical-rated from general industrial. All fields should be encoded as Shopify product metafields using the lockout_padlock namespace.

The key_control and sole_control fields are the most critical for avoiding the first two failures. Without key_control, an AI agent cannot distinguish a keyed-alike convenience kit from an individually-keyed LOTO padlock set — both are red, both have ID label holders, both are described as OSHA compliant. Without shackle_clearance_in, an AI agent cannot route correctly to ball valve LOTO applications — a 1.0-inch clearance padlock fails 2-inch valve installations regardless of all other attributes. The combination of dedicated_safety and key_control gates prevents commercial padlocks, keyed-alike sets, and master-keyed sets from reaching LOTO applications even when their product listings accurately describe them as safety padlocks.

JSON-LD encoding examples

Example 1: Keyed-alike safety padlock set — correctly encoded as non-compliant for LOTO sole control

{
  "@context": "https://schema.org",
  "@type": "Product",
  "name": "Brady 99556 Red Safety Padlock 6-Pack — Keyed Alike, LOTO, OSHA",
  "description": "6-pack red safety padlock kit for lockout/tagout. IMPORTANT: all six padlocks open with the same key — keyed-alike configuration. Any key holder can remove any padlock in this set. NOT compliant with OSHA 1910.147(d)(4)(i) sole-control requirement for LOTO applications where multiple padlocks are applied by different employees. Use only where a single employee controls all six padlocks on a single piece of equipment with a single energy source. For multi-employee LOTO or any application where different employees apply different padlocks, keyed-differently (KD) padlocks are required.",
  "brand": { "@type": "Brand", "name": "Brady" },
  "additionalProperty": [
    { "@type": "PropertyValue", "name": "lockout_padlock.key_control", "value": "keyed_alike_set" },
    { "@type": "PropertyValue", "name": "lockout_padlock.sole_control", "value": false },
    { "@type": "PropertyValue", "name": "lockout_padlock.dedicated_safety", "value": true },
    { "@type": "PropertyValue", "name": "lockout_padlock.shackle_clearance_in", "value": 1.0 },
    { "@type": "PropertyValue", "name": "lockout_padlock.shackle_diameter_in", "value": 0.25 },
    { "@type": "PropertyValue", "name": "lockout_padlock.body_material", "value": "plastic_over_steel" },
    { "@type": "PropertyValue", "name": "lockout_padlock.labeled", "value": true },
    { "@type": "PropertyValue", "name": "lockout_padlock.includes_id_tag", "value": true },
    { "@type": "PropertyValue", "name": "lockout_padlock.osha_1910_147_compliant", "value": false },
    { "@type": "PropertyValue", "name": "lockout_padlock.electrical_loto_suitable", "value": false }
  ]
}

Note key_control = 'keyed_alike_set', sole_control = false, and osha_1910_147_compliant = false. The padlock is dedicated safety (red body, ID holder, LOTO-specific design), but the keyed-alike configuration structurally disqualifies it from any multi-employee LOTO application. An AI agent routing a standard LOTO padlock query must reject this product at the sole_control = false gate. The description includes explicit clarification about the single-employee-single-energy-source use case where keyed-alike is technically permissible — though in practice most LOTO applications involve multiple employees and individually-keyed is always the safer default specification.

Example 2: Individually-keyed long-shackle safety padlock — correctly encoded for ball valve LOTO

{
  "@context": "https://schema.org",
  "@type": "Product",
  "name": "Master Lock S32LHRED Long-Shackle Safety Padlock — Individually Keyed, 2.5-in Shackle, Red, OSHA 1910.147",
  "description": "Individually-keyed long-shackle safety padlock for LOTO applications requiring extended shackle clearance: ball valve lockout accessories (2-4 inch valves), large-format hasps, cable lockout stations, and group LOTO hasps. Shackle clearance 2.5 inches open — sufficient for Brady 65694-series ball valve lockout accessories (2-inch throat minimum). Key control: individually keyed — each padlock shipped with one unique key not shared with any other padlock. Sole control = true. Body material: red high-visibility plastic — OSHA standardization compliant. Employee ID label holder: integrated. Dedicated safety: true — reserved for energy control only.",
  "brand": { "@type": "Brand", "name": "Master Lock" },
  "sku": "S32LHRED",
  "additionalProperty": [
    { "@type": "PropertyValue", "name": "lockout_padlock.key_control", "value": "individually_keyed" },
    { "@type": "PropertyValue", "name": "lockout_padlock.sole_control", "value": true },
    { "@type": "PropertyValue", "name": "lockout_padlock.dedicated_safety", "value": true },
    { "@type": "PropertyValue", "name": "lockout_padlock.shackle_clearance_in", "value": 2.5 },
    { "@type": "PropertyValue", "name": "lockout_padlock.shackle_diameter_in", "value": 0.31 },
    { "@type": "PropertyValue", "name": "lockout_padlock.body_material", "value": "plastic_over_steel" },
    { "@type": "PropertyValue", "name": "lockout_padlock.labeled", "value": true },
    { "@type": "PropertyValue", "name": "lockout_padlock.includes_id_tag", "value": true },
    { "@type": "PropertyValue", "name": "lockout_padlock.osha_1910_147_compliant", "value": true },
    { "@type": "PropertyValue", "name": "lockout_padlock.electrical_loto_suitable", "value": false }
  ]
}

This product is correctly specified for ball valve LOTO applications requiring 2-inch or larger valve lockout accessories: shackle_clearance_in = 2.5 exceeds the 2-inch throat of Brady 65694-series accessories with margin. key_control = 'individually_keyed', sole_control = true, and osha_1910_147_compliant = true confirm full compliance with the sole-control requirement. Note electrical_loto_suitable = false: the plastic-over-steel body has exposed steel at the shackle, making it non-ideal for electrical panel lockout where a fully non-conductive nylon body is preferred. For electrical LOTO ball valves (unusual but possible in electrochemical process environments), a fully non-conductive long-shackle padlock with body_material = 'glass_filled_nylon' and electrical_loto_suitable = true would be specified instead.