The loadsheet nobody signed: identity economics at the turnaround
Ask why ground handling runs on shared station accounts and you will get a security answer that misses the point. The reason is not carelessness. It is that provisioning an individual account for a handler agent who may work three shifts costs more than the shifts are worth, and everyone in the chain knows it.
Who signs the final loadsheet, and can you prove it?
A contracted handling agent, working in the airline's departure control system, frequently from a shared station account. Final loadsheet acceptance is a safety-critical decision about weight and balance, and the record it leaves names a session rather than a person.
- Shared station accounts persist because directory provisioning is priced for permanent employees and handling is staffed by a transient workforce.
- Any control that requires the airline's identity system to know every handler agent will fail on economics before it fails on security.
- A transient principal credential gives per-person attribution without adding anyone to a directory.
Part of Aviation and airworthiness identity
The honest version of why this happens
Here is the situation at a mid-size station. The airline contracts handling to a third party. That handler employs agents with high turnover, some seasonal, some shared across several airlines at the same airport. Agents need access to the airline's departure control system to check in passengers, manage the load, and produce the loadsheet.
To give each agent an individual account, the airline's identity team must onboard a person they do not employ, in a country they may not operate in, for a duration nobody can predict, and then remember to remove them. Multiply by two hundred stations.
So stations get accounts. Everyone involved understands the trade and nobody has a better option.
What is at stake in the loadsheet
Weight and balance is not administrative. A loadsheet error can place the centre of gravity outside limits, and the accident record contains the consequences of that in several jurisdictions.
The final loadsheet is produced by handler staff, transmitted to the flight deck, and accepted by the crew. The airline's record shows a station account produced it. If the figure was wrong, the investigation asks who calculated it and who checked it, and the answer is a station.
Why the usual remedies do not fit
| Proposed control | Why it does not deploy |
|---|---|
| Individual directory accounts for handler staff | Provisioning cost exceeds the value of the engagement; deprovisioning never happens |
| Biometric login at the station terminal | Capital cost per station; data protection exposure across many jurisdictions |
| Handler-side identity federation | Requires the handler to operate an identity provider the airline trusts; most cannot |
| Policy prohibiting account sharing | Already exists almost everywhere; the accounts are shared anyway |
The transient principal model
The design constraint is that attribution must not require the airline's directory to know the person.
A handler agent enrols a credential on their own device once, through the handler organisation. The airline's station system accepts a signed assertion from any credential presented under a delegation issued to that handler for that station, valid for a defined period.
The airline never provisions the individual. The handler manages its own roster, which it does anyway for payroll. The airline gets a record naming a specific credential, which resolves to a specific person through the handler's records when — and only when — an investigation requires it.
Where the evidence is thin
This record is graded conservatively and it should be. There is no public data on how prevalent shared station accounts are, and no published analysis linking loadsheet discrepancies to attribution failures. Both are widely believed within the industry and neither is documented.
An organisation considering this should therefore start by measuring rather than by buying: count station accounts, count distinct humans using them, and count loadsheet corrections per thousand departures. Those three numbers, produced internally, are worth more than any external claim including this one.
The scope that justifies itself first
If the numbers support action, start narrow. Final loadsheet acceptance only — not check-in, not boarding, not baggage. It is one action per departure, performed by one person, with the highest consequence in the handling workflow.
One action per departure is also a tractable pilot: a single station, ninety days, measured against the same station's prior loadsheet correction rate.
Why the economics push toward sharing
| Pressure | Effect on identity |
|---|---|
| Minutes on stand | Shared sessions stay open between staff |
| Contracted, high-turnover staff | Individual provisioning lags actual staffing |
| Multiple carriers per agent | One person works several airlines' systems in a shift |
| Safety-critical output | The one thing that needs attribution |
Objections and honest limits
“We would identify the individual from the roster.” A roster says who was working. It does not say who was at that terminal at 06:14, and in an investigation that distinction is the whole question.
“Individual logins would cost us minutes.” Which is why the signature should attach to the acceptance, not to the session. One gesture at the moment of acceptance, on a device the agent already carries.
Attributing the acceptance
- Leave the session shared. Fight the wrong battle and you lose the deployment.
- Bind only the acceptance. One gesture, at the single moment attribution matters.
- Render the figures being accepted. Zero fuel weight, take-off weight, index, and the limits.
- Carry the receipt with the flight record. So a later investigation is a retrieval.
Terms used here
- Loadsheet
- The document stating an aircraft's weight and balance for a departure, accepted before the flight is dispatched.
- Departure control system
- The airline system handling check-in, load control and dispatch, frequently accessed by contracted staff at shared stations.
- Attribution
- Connecting a recorded action to a specific person rather than to an account or a terminal.
Frequently asked questions
Is this a criticism of ground handlers? No. The shared-account practice is a rational response to a provisioning model that does not fit a transient workforce. The article's argument is that the model should change, not the people.
Who holds the mapping from credential to person? The handler, as part of its own employment records. The airline holds a credential identifier, which is sufficient for attribution and avoids the airline processing handler staff personal data.
What if an agent loses their device? Enrol a second authenticator, and provide a documented fallback that records an exception. A control that strands a station is not deployable.
Why is this record graded C? Because the prevalence and impact data are not public. The mechanism is sound; the size of the problem is asserted by the industry rather than measured.
Why not just issue individual logins? Provisioning lags high-turnover contracted staffing, and shared sessions persist because minutes on stand are expensive. Binding the acceptance rather than the session works with that reality.
What should the signature cover? The figures being accepted — zero fuel weight, take-off weight, index and the applicable limits — not just the fact of acceptance.
Who needs this evidence? Any investigation into a weight and balance discrepancy, and any regulator asking who certified the figures.
Where this fits in Manav
Manav binds an airworthiness or operational signature to the exact record it certifies, on a credential under one individual's sole control, and produces a receipt an auditor or a regulator can verify years later without access to the operator's systems.
Sources and further reading
- Industry ground handling operational standards addressing load control and weight and balance.
- Published accident and incident analyses involving weight and balance discrepancies.
- Departure control system access and station account documentation.
- FAA — regulations and policies
- FAA — Advisory Circulars