Every maintenance system can raise a work order. Kimberlite is built for what comes after: a supervisor who may not approve the job he raised himself, a permit that cannot outlive the ticket it was issued under, an hour meter with an extra zero in it stopped before it silently kills a truck’s whole PM programme.
No form and no sales call. The sign-in page names the accounts you can use and what each one is allowed to do — including the ones the platform will refuse.
services in production
12services in production
tests passing
2,300+tests passing
permission dimensions
5permission dimensions
declared duty conflicts
23declared duty conflicts
A demo that plays itself
Four things a maintenance system is usually bad at.
Not a video and not a screenshot — a reconstruction, built from the same components the product is, driven by a scripted cursor. A picture cannot show a control refusing, and a control that refuses and explains itself is the thing worth showing. Every figure in it comes from the seeded site behind the sign-in page.
Work order · C-4417TECH · EL · CREW A·S. Whitford
C-4417INPRG
HT-401 no start after engine swap
HT-401 · Haul Truck 401 · crew A · est 6.0 h
unit wont crank. checked batts ok. suspect start relay or ecm harness not seated after eng r&r. need lecky
Hours on the job3.5 hof 6.0 est
S. WhitfordEL3.5 hyesterday
Hours worked0.5–10,000−1.0h+
Book 1.0 h
0.51.02.04.08.012.0
Books to today against C-4417, as S. Whitford EL. Overtime is booked by whoever holds wo.approve_overtime for the crew.
Add a note or a different day
End of shift. Booking the hours is the last thing between a tradesperson and the bus.
Sequence 1 of 4
Eight hours booked in two taps
Wrench time is what a tradesperson is measured on, and in most systems it is the one thing they cannot write for themselves. Booking is the last act of a twelve-hour shift, on a tablet, in −38 °C nitrile gloves. So the common path is a preset and a button. A different day, somebody else’s hours, a note about waiting two hours on the crane — everything that is genuinely a decision — moves out of the way into a drawer.
Permissions
Deny wins. That is the whole argument.
Segregation of duties is where most maintenance platforms quietly give up, and it is not a small thing to give up on — self-approved spend is the most common segregation-of-duties violation there is in a maintenance function.
A union of roles cannot be a control
IBM Maximo resolves a person to the union of their roles’ highest grant. Hand somebody a second role and the conflict does not raise an alarm — it dissolves, which makes segregation of duties advisory at best. Kimberlite denies first. An explicit deny beats every grant it meets, a handful of capabilities are never granted to anyone at all, and twenty-three declared conflicts are checked at the moment of the transaction — several of them against the record in hand, so “approve a work order” and “approve the work order you raised” are different questions with different answers.
Every attempt is written to the audit log, allowed or refused. The refused ones are the interesting half: a refusal is the only evidence that a control ran at all.
Five dimensions, not one
Treating “role” as the only axis is the standard CMMS failure. A decision here considers, in order:
1capabilityis the verb granted at all
2scopeown · crew · site · all sites · vendor · storeroom
3sub-scopethis storeroom, this crew, this GL component
4valuean approval ceiling in dollars
5fieldread-only, hidden or masked, per model and field
Plus two gates over the top of them: never-granted, and a certificate that has to be current right now.
A lapsed ticket stops a signature
Certification is checked at the instant of the action, not at the moment the role was granted — and the certificate that was accepted is copied onto the record it authorised. A permit’s validity is then capped at that certificate’s expiry, truncated rather than refused, so the crew still gets the hours the ticket does cover and the permit is an honest document about what authorised it. Renew the ticket, lose it, let it lapse: the permit still says what was true when it was issued.
Issuer certificate, as stored on PTW-3301
type
WSCC_SUPERVISOR
number
WSCC-NT-88214
issuer
Workers' Safety and Compensation Commission (NWT & NU)
expires
in 6 days
Copied at issue, not looked up afterwards — and the permit’s own window may not end later than this date.
Records
Records, not flags.
A maintenance system is an evidence system. Most of what a mine is audited on is not whether the work happened — it is whether the record of it can be trusted six months later, by somebody who was not there.
Permit to work and lock-out/tag-out
First-class records with their own lifecycle, not a checkbox on a work order. A permit is a sequence of named people each attesting to something at a time, and the seats nobody has been named to yet are what the work party standing at the gate actually needs to read.
Evidence with SHA-256 digests
Attachments are addressed by the digest of their content, so the photograph of a torque wrench reading or a scanned signature cannot be swapped for a different one after the fact without the record saying so.
An immutable cost ledger
Transactions are append-only — no updated_at, no updated_by, and a guard in the ORM mirrored by a trigger in the database, so the refusal does not depend on the application remembering not to try. Every total on every screen is derived from the transactions, never stored beside them.
Downtime as an interval
Every downtime record carries its own explicit operating-time denominator. Availability is computed from intervals against that denominator, never inferred from when a work order happened to be opened and closed — which is the number most CMMS platforms quietly report as availability.
ISO 14224 failure coding
Validated against the asset class, so a structural code cannot be filed against a pump. Reliability reporting is only worth the coding discipline underneath it.
One action layer, all of it audited
Every mutation in the platform goes through one action registry with a declared capability, a risk level and an audit row — written outside the business transaction, so a rollback cannot take the record of the attempt with it.
Several mines, one page, no averages
A group maintenance executive does not run any of the mines; they decide which one to spend a week at. That decision is not made from a total — it is made from the distance between the sites. So the roll-up draws the spread between the best mine and the worst with each mine’s own dot on it, names which end is bad for each figure, and refuses to plot a mine it has no answer for.
Four sites at 88% availability and one at 54% average to 81%, which reads as a fleet with a problem nobody can locate. And the reach is not a filter on a query: multi-site is enforced by row-level security in Postgres, with reads spanning the sites an account is provisioned for and writes pinned to exactly one. An account that can read three mines can still only write to its own — a property of the database rather than a habit of the application.
The site
The pit has no signal.
Lac de Gras is 300 km from the nearest town, resupplied over an ice road that is open about ten weeks a year, and worked on a two-weeks-on rotation. Software that assumes a network is software that gets filled in from memory the following Tuesday.
Offline-first
Underground and in the pit there is no link, so a write is queued on the device and sent when there is one. The tray says which of your hours have not landed yet, and a session survives a reload — a technician who refreshes with no signal must not be stranded outside the shell holding their shift’s work.
Where a replay could collide with somebody else’s change, it is parked and shown rather than silently applied — except where the arithmetic is additive, like two people booking their own hours to the same job, where both are correct.
An agent that cannot outrank you
There is an AI assistant, and it is bounded by the person asking. The caller’s own bearer token travels to every service it touches, and each service re-checks the request with the record in hand — so scope, approval ceilings and segregation of duties apply to the agent exactly as they apply to the person who asked.
The agent carries low-risk authority only: anything medium or high comes back as an approval for a person to give in their own authority. And a permission denial is terminal — it says which permission is missing and stops, rather than looking for another route to the same result.
Everything on this page is running in the thing you can sign into.
Two seeded mines, a full roster of people with genuinely different permissions, and a platform that will refuse you when you sign in as the wrong one. Find the refusals — they are the part worth testing.
Book eight hours to a job in two taps. Then read what is simply not on their screen — a capability nobody will ever hold takes its control with it.
As a crew supervisor
Approve the crusher lube pump replacement. It is priced at $42,000 and the supervisor’s ceiling is $10,000, so it goes to the maintenance manager or nowhere.
As the group executive
Open the roll-up. Two mines, the spread between them rather than an average, and every figure named with the capability that bought it.
Command palette
Jump to a screen, or run an action you are permitted to run.