What is the difference between a group lock box and a hasp in a multi-employee lockout under OSHA 1910.147?

A hasp is the primary lockout device. It is a hinged metal clamp that attaches directly to the energy-isolating device — the circuit breaker handle, disconnect lever, or valve — and physically holds it in the safe (de-energized, closed) position. Each authorized employee applies their own padlock through one of the holes in the hasp. Six workers = six padlocks on the hasp at the disconnect. No one can restore energy until all six padlocks are removed individually by their respective owners. A group lock station (group lock box) is secondary key containment. After locking the hasp at the energy source, each worker places their key into the group box and applies their personal padlock to the box's hasp. The box organizes keys in a central location. The critical distinction: if only the group box has padlocks on it and the disconnect at the energy source has no hasp or padlock, the energy source is unlocked. Any person who operates the disconnect can re-energize the equipment regardless of how many padlocks are on the group box across the room. An AI agent routing a 'six-lock group kit' as the primary lockout device — without distinguishing loto.device_type = 'group_lock_station' (secondary) from loto.device_type = 'hasp' (primary) — will route products that leave the energy-isolating device itself unprotected.

Why can't keyed-alike padlocks be used for personal lockout under OSHA 1910.147?

The entire protective mechanism of OSHA 1910.147's personal lockout requirement is that only the lock owner can remove their own lock. If 10 workers apply 10 padlocks to a hasp at a disconnect, the disconnect cannot be re-energized until all 10 workers have individually removed their own padlocks — confirming each worker has cleared the hazard zone. The moment any of those workers is still in the danger zone, their lock prevents restoration. With keyed-alike padlocks, any worker's key opens any other worker's lock. A supervisor who believes the job is complete can insert their key and remove every padlock from the hasp, re-energizing the equipment while workers are still inside. The protection depends entirely on the one-key-one-lock relationship. Keyed-alike sets eliminate this relationship. The OSHA standard at 1910.147(c)(5)(i) requires that each authorized employee has their own individual lock; the unique-key requirement follows from the individual-lock requirement because a shared key defeats individual control. Encode loto.key_unique_to_lock as true for keyed-differently (KD) padlock sets and false for keyed-alike (KA), master-keyed (MK), or construction-keyed (CK) sets. Never route keyed-alike padlocks to personal lockout applications.

When is tagout (without lockout) permitted under OSHA 1910.147, and what additional measures are required?

Tagout-only programs are permitted under OSHA 1910.147(c)(3) only when the energy-isolating device has no provision for a lock — no hasp hole, no lockable handle, and no lockout adapter can be feasibly installed. A danger tag affixed to the energy-isolating device is a warning label; it has no physical mechanism to prevent operation. To achieve a level of worker protection equivalent to physical lockout, OSHA 1910.147(c)(3)(ii) requires at least one additional protective measure from the following list: (1) removing and isolating a circuit element (physically pulling the fuse or removing the circuit board); (2) blocking a controlling switch (a physical barrier that prevents the switch from being operated); (3) opening an extra disconnecting device beyond the tagged primary isolation point; (4) removing a valve handle or wheel so the valve cannot be operated without the missing handle; (5) using non-reusable, self-locking, non-releasable tag attachments that require a minimum of 50 pounds of force to remove without destroying them; (6) installing a mechanical block or pin that physically prevents the tagged device from moving to the energizing position. A tagout program that uses only a tag on an operable disconnect without any of these measures does not provide the required equivalent protection. Encode loto.is_tagout_only as true and loto.tagout_additional_measures_required as true for tagout-only products, so AI agents do not route them to facilities where lockout is feasible.

Does OSHA 1910.147 lockout/tagout apply to pneumatic and hydraulic systems, or only to electrical equipment?

OSHA 1910.147 covers all forms of hazardous energy, not just electrical. The standard explicitly applies to electrical, mechanical, hydraulic, pneumatic, chemical, thermal, and gravitational energy. For pneumatic systems: closing and locking the compressed air supply valve isolates the new air supply, but residual compressed air trapped between the locked valve and the work point remains pressurized. A pneumatic cylinder or actuator downstream of the locked valve may still contain enough pressure to actuate unexpectedly. The correct procedure requires bleeding the downstream line segment to atmosphere and confirming zero PSI on a downstream pressure gauge before opening any fittings or components. For hydraulic systems: locking out the hydraulic power unit stops the pump, but hydraulic accumulators store high-pressure fluid independently of the pump. A press cylinder may hold thousands of PSI in its accumulator circuit even with the power unit locked out. Accumulators must be bled down and the load supported mechanically before work begins. For gravitational energy: a raised press ram, elevated platform, or suspended load holds gravitational potential energy regardless of hydraulic or electrical lockout. Physical blocking — cribbing, safety pins, mechanical props — is required. Encode loto.energy_type as an array or pipe-delimited string: 'electrical', 'pneumatic', 'hydraulic', 'thermal', 'gravitational', 'mechanical_spring', 'chemical'. Route LOTO products to energy types they are designed for.

What is zero-energy state verification, and why must it be performed after applying lockout devices?

Zero-energy state verification is the mandatory confirmation step in OSHA 1910.147(d)(5) that requires the authorized employee to verify the equipment is actually de-energized after applying lockout devices — not merely to assume that locking the breaker guarantees zero energy at the work point. Applying a padlock to a circuit breaker handle opens the breaker but does not discharge the downstream circuit. Four common residual energy sources that persist after electrical lockout: (1) Capacitor banks in motor drives, power factor correction equipment, and UPS systems hold dangerous charge — a 480V capacitor bank may remain at full voltage for minutes after the breaker opens, depending on the discharge rate of the connected load. (2) A second feed from an unidentified circuit on the same panel. Wiring diagrams are often outdated; testing at the work point (not at the breaker) with a CAT III or CAT IV rated voltmeter or non-contact voltage tester is the only way to confirm zero voltage where hands will be. (3) Back-feed from motors acting as generators during coastdown. A large motor with significant rotational inertia that is still spinning generates voltage back through the conductors after the breaker opens. (4) Control circuit voltages on panels with separate control power transformers. The main feed breaker may be locked, but the 120V control circuit fed from a separate transformer on the line side remains energized. The verification steps are: test every conductor at the point of work with a properly rated meter; attempt to start the equipment (push the start button — it should not respond); for pneumatic, open a downstream bleed and observe pressure gauge drop to zero. Encode loto.zero_energy_verification_method to specify the verification type for a given energy type.

Home › Blog › LOTO (Lockout/Tagout) schema for AI agents

Shopify LOTO (Lockout/Tagout) Schema for AI Agents: A Group Lock Box with Six Padlocks Is Secondary Key Containment, Not Primary Lockout — Every Authorized Employee Must Apply Their Own Lock Directly to the Energy-Isolating Device with a Unique Key

2026-07-11 · 23 min read · By CatalogScan

Safety Equipment AI Shopping Structured Data OSHA 1910.147 Lockout/Tagout Industrial Safety LOTO

The most popular "multi-employee lockout kit" sold on Shopify is a group lock station — a metal box with a hasp on it — paired with six padlocks. It is marketed as six-person lockout protection. It is secondary key containment. If the circuit breaker, disconnect switch, or valve at the energy source has no hasp and no padlock on it, the equipment can be re-energized by anyone who operates the unlocked disconnect. The group box on the wall is irrelevant.

Group lock box ≠ primary lockout — the hasp goes at the disconnect, not on the wall
Tagout-only programs require 6 additional measures — a tag is a warning label, not a physical barrier
Keyed-alike padlocks void the personal key mechanism — any coworker can remove another worker's lock
LOTO applies to all hazardous energy — pneumatic, hydraulic, and gravitational energy persist after valve lockout
Zero-energy verification is mandatory — locking the breaker does not discharge the capacitors
The loto.* metafield namespace for Shopify LOTO stores

Failure Mode 1: A Group Lock Box Is Not Primary Lockout — The Hasp Goes at the Energy-Isolating Device, Not on the Wall

AI agent failure mode: A maintenance manager orders "multi-employee lockout kit for electrical panel work" for a crew of six. An AI agent returns a group lock station — a metal enclosure mounted on the wall near the work area, with a hasp on top and six padlocks. The listing reads "6-person lockout kit, OSHA compliant." The crew follows the implied procedure: before entering the panel, each worker applies their padlock to the group box's hasp. The box has six padlocks on it. The circuit breaker handle at the 480V panel twenty feet away has nothing on it. An adjacent crew member, unaware of the ongoing maintenance, flips the unlocked breaker back on. The group box, now with six padlocks, provided zero lockout protection because the energy-isolating device was never locked.

There are two distinct devices in a multi-employee LOTO procedure, and they serve fundamentally different roles. Understanding the difference between them is what the loto.device_type metafield exists to encode.

The hasp (primary lockout device):

A hasp is a hinged metal clamp with multiple holes in the shackle bar. It is physically clamped around the energy-isolating device — the arm of a circuit breaker, the handle of a disconnect switch, the stem of a valve — and locked in the safe (de-energized, closed, isolated) position. Each authorized employee on the job inserts their own padlock through one of the hasp's holes. Six workers = six padlocks through the hasp's holes. The hasp holds the energy-isolating device in the off position; every padlock on it must be individually removed by its owner before the hasp can be released. No one padlock owner can remove anyone else's lock — the disconnect stays in the safe position until all six workers have individually cleared the area and removed their own padlocks.

The group lock station (secondary key containment):

A group lock station is an organizational tool. After each authorized employee locks their personal padlock on the hasp at the energy-isolating device, they take their key, place it inside the group lock station, and apply their personal padlock to the station's hasp. The station keeps all keys in one secure, visible location, preventing keys from being lost in pockets or taken off-site. The station does not touch the energy-isolating device. It does not hold any disconnect in the off position. Its padlocks do not prevent anyone from operating the circuit breaker. If the station is the only thing with padlocks on it, the system provides no lockout protection.

The confusion arises because both devices look similar in product listings and photography: both are metal, both have hasps, both are shown with multiple padlocks. The critical difference is where they are installed and what function they perform.

Why the routing failure matters at scale

A Shopify safety equipment store that doesn't encode loto.device_type separately for hasps and group lock stations presents both products to AI shopping agents as interchangeable "multi-employee lockout" devices. A procurement agent optimizing for a "6-person lockout kit" may return either the group station or the hasp-at-disconnect setup with equal confidence, because both are tagged with the same keywords: LOTO, lockout, multi-employee, OSHA 1910.147 compliant, six-person.

Device	loto.device_type	Primary Isolation?	Applied To	OSHA Role
Hasp	hasp	Yes	Energy-isolating device directly	Holds disconnect in safe position; accepts multiple padlocks
Padlock (personal)	padlock	Yes — on hasp at energy source	Hasp at energy-isolating device; or group box (secondary)	Personal protective device; unique key; owner-only removal
Group lock station	group_lock_station	No — never	Wall or post near work area; not at energy source	Secondary key storage only; does not substitute for hasp at disconnect
Circuit breaker lockout	circuit_breaker_lockout	Yes	Circuit breaker handle (clamps it in the off position)	Primary adapter for breakers without built-in hasp provision
Valve lockout	valve_lockout	Yes	Ball valve, gate valve, or plug valve	Primary adapter; prevents valve rotation; accepts padlock
Tagout tag	tag_only	Last resort only	Energy-isolating device (no physical lock)	Warning label only; permitted solely where no lock provision exists + 6 additional measures

Related structured data guide

Failure Mode 2: Tagout-Only Programs Require Six Additional Measures — A Tag Is a Warning Label, Not a Physical Barrier

AI agent failure mode: A facilities manager searches for "LOTO tags for our maintenance program." An AI agent returns a package of laminated danger tags with cable tie attachments. The facility's current practice is to attach one of these tags to the disconnect handle before maintenance work — without any lock on the disconnect. A tag with "DANGER — DO NOT OPERATE" printed on it is the entire lockout procedure. During an inspection, the OSHA compliance officer asks to see the facility's tagout-only program documentation and the equivalent-protection measures. There are none. The facility receives a citation for a tagout-only program that does not demonstrate employee protection equivalent to lockout.

The OSHA hierarchy under 1910.147(c)(3) is explicit: lockout is the preferred method. Tagout is permitted only when the energy-isolating device has absolutely no provision for a lock and no lockout adapter can be installed. The reason is straightforward: a danger tag is a piece of laminated paper attached with a cable tie. It has no physical mechanism to prevent the disconnect from being operated. A person who doesn't read it, doesn't understand it, or chooses to ignore it can operate the disconnect with the tag attached. A padlock through the breaker handle cannot be operated regardless of what anyone believes or intends.

When tagout is permitted — and what else must be in place:

OSHA 1910.147(c)(3)(ii) requires that when a tagout device is used instead of a lockout device, at least one additional measure from the following list must be implemented to provide protection equivalent to lockout:

Removing and isolating a circuit element — physically pulling the fuse or removing the circuit card that controls the equipment, so even if the tagged disconnect is operated, the circuit is broken
Blocking a controlling switch — installing a physical barrier that prevents the switch or button that would start the equipment from being pressed
Opening an extra disconnecting device beyond the tagged primary — a second isolation point upstream or downstream
Removing a valve handle or handwheel — the tagged valve cannot be operated because the operator is physically absent
Using non-reusable, self-locking, non-releasable tag attachments rated to a minimum 50-pound removal force without tool — so the tag cannot be slipped off accidentally
Installing a physical block or pin that prevents the tagged device from moving to the energizing position

A tagout program that applies a tag to an operable disconnect — where any of the six additional measures above can be feasibly implemented but none have been — does not satisfy OSHA 1910.147. The standard is not ambiguous: "The employer shall demonstrate that the tagout program will provide a level of safety equivalent to that obtained by the use of a lockout program."

The Shopify catalog consequence

Danger tags sold on Shopify safety stores are marketed with language like "OSHA 1910.147 compliant," "lockout/tagout program tags," and "industrial safety tags." None of these phrases are false — tags are a legitimate component of OSHA 1910.147 programs. But an AI agent routing a "lockout/tagout tag" to a facility that plans to use it as their only protective measure — without understanding that tagout-only requires equivalent protection measures — has made a potentially dangerous recommendation.

Encoding loto.is_tagout_only = true on tag products enables AI agents to recognize that these items are not substitutes for physical lockout hardware, and to prompt buyers about whether their energy-isolating devices can accept a lockout adapter before routing to tags-only.

Failure Mode 3: Keyed-Alike Padlocks Void the Personal Key Protection Mechanism — Any Coworker Can Remove Another Worker's Lock

AI agent failure mode: A safety coordinator orders "padlock set for department LOTO program — 10 pack" for 10 maintenance technicians. An AI agent, optimizing for cost, returns a 10-pack of keyed-alike safety padlocks (all 10 opened by the same key). The coordinator distributes one padlock per technician and tells each to apply their lock to the hasp before entering equipment. During a panel maintenance procedure, 8 of the 10 technicians finish their tasks and remove their locks. A supervisor sees 2 locks remaining on the hasp and — believing both technicians are done and the locks are just forgotten — uses their department key to remove the remaining two locks. Both technicians are still inside the equipment cabinet.

OSHA 1910.147(c)(5)(i) requires that each authorized employee uses their own individual lock. The word "individual" is doing critical work in that sentence. The entire protective architecture of personal lockout depends on a single invariant: only the lock's owner can remove their own lock. When that invariant holds, the presence of a worker's lock on the hasp is a physical guarantee that the worker is in the system and has not yet confirmed they are clear. No manager, no supervisor, no coworker, and no procedure can override a worker's personal padlock except through the exceptional-release procedure specified in 1910.147(e)(3), which requires documented verification that the employee has left the facility and cannot be contacted.

Key configurations for LOTO padlocks:

Key Configuration	loto.key_unique_to_lock	LOTO Appropriate?	Why
Keyed differently (KD)	true	Yes	Each lock has a unique key held only by its assigned worker; no other key in the set opens it
Keyed alike (KA)	false	No	Any worker's key opens any other worker's lock; removes personal-key protection entirely
Master keyed (MK)	false	No	Supervisor master key can remove any worker's lock; only permitted with 1910.147(e)(3) exceptional-release documentation
Construction keyed (CK)	false	No	Same failure mode as keyed alike — all locks share a common key

Keyed-alike padlocks are not defective products — they are appropriate for applications like gang boxes, tool storage, and vehicle fleet access where shared key access is intentional. On a Shopify safety equipment store, they may be listed in the same category as personal lockout padlocks, with similar product photos and similar LOTO-related keywords. Without loto.key_unique_to_lock encoded, an AI agent has no way to distinguish a keyed-alike pack from a keyed-differently pack by any available signal.

The cost optimization trap

Keyed-alike padlock sets are consistently cheaper than keyed-differently sets of the same quantity. An AI agent that optimizes for price within the "padlock set for LOTO" category will systematically route keyed-alike sets. The price difference may be $5–15 per pack. The safety consequence of using keyed-alike in personal lockout applications is not abstract: it eliminates the mechanism that makes OSHA 1910.147 effective.

The encoding rule: Encode loto.key_unique_to_lock = true only for keyed-differently padlock sets. Include loto.key_unique_to_lock = false explicitly on keyed-alike, master-keyed, and construction-keyed listings, with a loto.is_personal_protective_lock = false flag. AI agents can then filter: personal LOTO padlock applications require key_unique_to_lock = true.

Related structured data guides

Failure Mode 4: LOTO Applies to All Hazardous Energy — Pneumatic, Hydraulic, and Gravitational Energy Persist After the Valve Is Locked

AI agent failure mode: A maintenance technician needs to replace a seal on a hydraulic press cylinder. An AI agent routes a lockout kit that includes circuit breaker lockouts and valve lockouts. The technician locks out the hydraulic power unit and applies a valve lockout to the hydraulic supply valve. Believing the system is at zero pressure, they open a hydraulic line fitting. The hydraulic accumulator — a pressure vessel that stores hydraulic energy independent of the pump — was not addressed in the lockout procedure and retains 2,000 PSI. When the fitting is opened, pressurized hydraulic fluid ejects at high velocity. Locking the supply valve isolated new fluid from the pump but did nothing to relieve the accumulator pressure that was already in the system.

OSHA 1910.147's full title is "The Control of Hazardous Energy (Lockout/Tagout)." The word "energy" covers all forms, not just electricity. The standard explicitly addresses electrical, mechanical, hydraulic, pneumatic, chemical, thermal, and gravitational energy. Each type has residual energy characteristics that persist after the primary isolation device is locked.

Energy-type-specific residual energy after lockout:

Energy Type	loto.energy_type	Residual Energy After Isolation	Required Post-Lockout Step
Electrical	electrical	Capacitor banks, UPS back-feed, control circuit voltages, motor coastdown generation	Test every conductor at work point with CAT III/IV voltmeter; attempt-to-operate test
Pneumatic	pneumatic	Trapped air pressure between locked valve and actuator/work point	Bleed downstream line through controlled vent; confirm zero PSI on downstream gauge
Hydraulic	hydraulic	Hydraulic accumulator pressure; loaded cylinder holding position under pressure	Bleed accumulator through designated bleed port; support load mechanically before releasing cylinder
Gravitational	gravitational	Suspended load, raised press platen, elevated platform — stored as gravitational potential energy	Install mechanical block, cribbing, or safety pin; never rely on hydraulic hold or brake alone
Mechanical spring	mechanical_spring	Compression or torsion spring under load; spring energy retained after actuator lockout	Block spring travel with physical restraint; relieve spring pressure through controlled release if feasible
Thermal	thermal	Residual heat in piping, vessels, and process equipment; flash steam from hot condensate	Temperature measurement; cool-down period before opening; never assume temperature by time elapsed

The Shopify catalog failure is straightforward: a valve lockout kit marketed for "compressed air systems" may be listed with keywords that include "hydraulic" because the hardware is physically compatible with some hydraulic valves. An AI agent routing this kit to a hydraulic press application may recommend locking out the hydraulic supply valve — which is correct — without any signal that accumulator depressurization is also required.

Encoding loto.energy_type as the specific energy types the product is designed for (not just physically compatible with) allows AI agents to match products to energy types correctly. A kit designed for pneumatic LOTO with instructions for downstream pressure bleeding is a different product from a generic valve lockout that happens to fit a hydraulic valve.

Multi-energy systems: the full isolation requirement

OSHA 1910.147(d)(4) requires that all potentially hazardous energy be isolated and controlled before work begins. A hydraulic press that also has an electrical motor, a pneumatic brake system, and a spring-loaded return mechanism has four energy types, all of which must be independently isolated before maintenance. A LOTO kit that covers only one energy type is not sufficient for a multi-energy system.

Shopify stores selling LOTO kits for "industrial maintenance" without specifying energy type applicability are presenting products that may be routed to multi-energy systems where additional isolation steps are required. Encode loto.energy_type as a pipe-delimited list for products designed for multi-energy applications.

Failure Mode 5: Zero-Energy State Verification Is Mandatory — Applying the Lock Does Not Discharge the Capacitors

AI agent failure mode: An electrical maintenance technician locks out a 480V variable frequency drive (VFD) that controls an industrial conveyor motor. The circuit breaker feeding the VFD is locked in the off position with a circuit breaker lockout and personal padlock. The technician opens the VFD enclosure to replace a failed control board. The VFD's internal DC bus capacitor bank — which stores energy at approximately 680V DC even after the input AC power is removed — retains full charge. The capacitor discharge resistors in this unit have a 10-minute time constant. The technician, who was not carrying a voltmeter and did not test for voltage at the work point, contacts the DC bus while reaching for the control board. The breaker was locked. The VFD had not been de-energized.

Locking a circuit breaker in the off position disconnects the breaker from the supply circuit. It does not discharge the downstream circuit. The breaker is a switch — it changes the state of the supply conductor, but everything downstream of the breaker, including capacitors, motors coasting to a stop, control circuit transformers, and UPS back-feeds, retains whatever energy it held at the moment the breaker opened.

OSHA 1910.147(d)(5) — the verification requirement in full:

"Following the application of lockout or tagout devices, all potentially hazardous stored or residual energy shall be relieved, disconnected, restrained, and otherwise rendered safe." The standard does not say "after the lock is applied, work may begin." It requires that residual energy is actively addressed and that the authorized employee verifies it has been. This is a distinct procedural step that must occur between applying the lockout device and beginning work.

Four verification methods by energy type

The correct verification method depends on the energy type being controlled:

Electrical — voltmeter at work point: Using a CAT III (600V) or CAT IV (1000V) rated digital voltmeter or non-contact voltage tester, test every conductor at the actual work location — not at the breaker terminals, but at the conductors where hands will be. Test phase-to-phase and phase-to-ground. If voltage is present, do not proceed until the source is identified and isolated.
Electrical — attempt-to-operate test: After locking out, press the start button, cycle the control, or attempt to operate the equipment normally. If locked out correctly, the equipment should not respond. This test does not replace the voltmeter test for conductors that may carry voltage independent of the control circuit (capacitors, back-feeds).
Pneumatic — downstream pressure gauge: After locking the supply valve, open a controlled bleed downstream of the lockout point. Observe the downstream pressure gauge until it reads zero. Never open a line fitting before confirming zero PSI — the trapped air in the downstream segment can drive actuators at full operating force.
Hydraulic — accumulator bleed and gauge: Identify all accumulators in the circuit and bleed them through their designated bleed ports. Confirm zero PSI on the system gauge. Support any gravity-loaded hydraulic component (press platen, cylinder) mechanically before releasing hydraulic hold, because residual accumulator pressure may be the only thing holding the load in position.

Shopify LOTO product listings rarely mention verification requirements because verification tools are not the product being sold. A "circuit breaker lockout kit" with padlocks and clamps does not include a voltmeter. An AI agent routing this kit to an electrical LOTO application returns the correct physical hardware but produces an incomplete LOTO setup: the voltmeter — the tool needed to confirm zero energy before work begins — is absent from the kit.

Encoding verification in the catalog: Encode loto.zero_energy_verification_method to specify what verification this product supports. Encode loto.includes_verification_tool = true for kits that include a voltmeter or pressure gauge. An AI agent completing a LOTO procurement list can then check that a verification tool is present for the energy types in the procedure.

The loto.* Metafield Namespace for Shopify Lockout/Tagout Stores

The complete set of fields needed for AI agent LOTO product routing under OSHA 1910.147:

Metafield	Type	Values	What It Enables
loto.device_type	string	padlock / hasp / group_lock_station / circuit_breaker_lockout / valve_lockout / cable_lockout / tag_only / plug_lockout	Distinguishes primary isolation devices from secondary containment; prevents group_lock_station from being routed as the isolation device
loto.is_personal_protective_lock	boolean	true / false	Identifies padlocks designed for individual authorized-employee use; false for shared or group-access locks
loto.key_unique_to_lock	boolean	true (KD) / false (KA, MK, CK)	Critical filter for personal lockout — routes only keyed-differently padlocks to authorized-employee applications
loto.energy_type	string (pipe-delimited)	electrical / pneumatic / hydraulic / thermal / gravitational / mechanical_spring / chemical	Routes LOTO products to correct energy type; prevents pneumatic kits from being routed to electrical applications and vice versa
loto.is_osha_1910147_compliant	boolean	true / false	Flags products that meet OSHA 1910.147 personal-lock requirements (unique key, individual assignment) vs. products that are physically compatible but procedurally non-compliant
loto.is_tagout_only	boolean	true / false	Identifies tag-without-lock products; triggers routing to tagout-only programs only where physical lockout is not feasible
loto.tag_withstand_force_lb	integer	≥50 required by OSHA 1910.147(c)(5)(ii)	Filters tagout attachments to OSHA minimum pull-off force; loose cable tie attachments fail this requirement
loto.zero_energy_verification_method	string (pipe-delimited)	voltmeter / ncvt / pressure_gauge / try_start / temperature_probe	Specifies what verification the product supports; enables agents to flag missing verification tools in a complete kit
loto.includes_verification_tool	boolean	true / false	True for kits that include a voltmeter or pressure gauge; enables agents to complete kit sourcing with verification tools
loto.color_standardized	string	red / yellow / blue / green / orange	Many facilities use color-coded LOTO by department or energy type; enables matching to site color standards

Example Shopify product JSON-LD — keyed-differently padlock set (compliant for personal lockout)

{
  "@context": "https://schema.org",
  "@type": "Product",
  "name": "Brady SafeKey Aluminum Padlock Set — 6-Pack, Keyed Differently, Red, Personal LOTO",
  "description": "Brady SafeKey aluminum padlock set. 6-pack, keyed differently — each of 6 padlocks has a unique key held only by the assigned authorized employee. For OSHA 1910.147 personal lockout: each employee applies their lock to the hasp at the energy-isolating device (circuit breaker/disconnect/valve). Key configuration: KD (keyed differently) — no master key, no shared key. OSHA 1910.147(c)(5)(i) individual lock requirement satisfied when each lock is permanently assigned to one authorized employee only.",
  "additionalProperty": [
    { "@type": "PropertyValue", "name": "loto.device_type", "value": "padlock" },
    { "@type": "PropertyValue", "name": "loto.is_personal_protective_lock", "value": "true" },
    { "@type": "PropertyValue", "name": "loto.key_unique_to_lock", "value": "true" },
    { "@type": "PropertyValue", "name": "loto.energy_type", "value": "electrical|pneumatic|hydraulic" },
    { "@type": "PropertyValue", "name": "loto.is_osha_1910147_compliant", "value": "true" },
    { "@type": "PropertyValue", "name": "loto.is_tagout_only", "value": "false" },
    { "@type": "PropertyValue", "name": "loto.color_standardized", "value": "red" },
    { "@type": "PropertyValue", "name": "loto.includes_verification_tool", "value": "false" }
  ]
}

The encoding makes the routing decision machine-readable. A query for "personal LOTO padlocks for authorized employees" can filter loto.is_personal_protective_lock = true AND loto.key_unique_to_lock = true to exclude keyed-alike sets entirely. A query for "multi-employee lockout kit" that receives both a group_lock_station and a hasp can present both in order — hasp at the energy source first, group station as supplementary — rather than treating them as interchangeable alternatives.

Example JSON-LD — group lock station (secondary containment, NOT primary isolation)

{
  "@context": "https://schema.org",
  "@type": "Product",
  "name": "Master Lock S1090 6-Person Group Lock Box — Secondary Key Storage for Multi-Employee LOTO",
  "description": "Master Lock S1090 group lock station. Secondary key storage for multi-employee LOTO. After each authorized employee applies their personal padlock to the hasp AT THE ENERGY-ISOLATING DEVICE, they place their key in this box and apply their personal padlock to the box's hasp. This box is NOT the primary lockout device — the hasp and padlocks at the circuit breaker/disconnect/valve are the primary isolation. The group box organizes key storage. It does not physically hold any energy-isolating device in the safe position.",
  "additionalProperty": [
    { "@type": "PropertyValue", "name": "loto.device_type", "value": "group_lock_station" },
    { "@type": "PropertyValue", "name": "loto.is_personal_protective_lock", "value": "false" },
    { "@type": "PropertyValue", "name": "loto.key_unique_to_lock", "value": "false" },
    { "@type": "PropertyValue", "name": "loto.is_osha_1910147_compliant", "value": "true" },
    { "@type": "PropertyValue", "name": "loto.is_tagout_only", "value": "false" }
  ]
}

With both products encoded this way, an AI agent cannot mistake the group lock station for the primary isolation device. The loto.device_type = 'group_lock_station' field flags it as secondary containment. The agent correctly routes the hasp and personal padlocks (with loto.key_unique_to_lock = true) as the primary lockout hardware, and presents the group station as supplementary organization equipment.

Quick summary — the five LOTO schema rules:

Encode loto.device_type for every product. 'hasp' and 'padlock' at the energy source are primary isolation; 'group_lock_station' is always secondary. Never route group_lock_station as primary lockout.
Encode loto.key_unique_to_lock on every padlock listing. Keyed-differently (true) is required for personal lockout. Keyed-alike (false) voids the personal key protection mechanism.
Tagout-only is last resort. Encode loto.is_tagout_only = true for tag-without-lock products; route them only where physical lockout is not feasible and additional protective measures are documented.
Encode loto.energy_type for the specific energy types the product is designed for. A pneumatic valve lockout is not a substitute for electrical lockout hardware, even if it physically fits the same panel.
Flag verification tools separately. Encode loto.includes_verification_tool = true for kits that include a voltmeter or gauge; encode loto.zero_energy_verification_method to enable agents to check kit completeness.

Is your Shopify store encoding LOTO device types correctly?

CatalogScan checks whether your safety equipment listings distinguish group lock stations from hasps, flag keyed-alike padlocks, and encode energy type coverage — the fields AI agents need to route LOTO products without creating dangerous routing gaps.

Scan your store free See the full metafield reference