For transit agencies, ports and public authorities
Operations control, in-service dispatch and anything safety-critical are outside this permanently — a dependency there is a risk with no mitigation. Accessibility eligibility is a civil right and is determined by your staff. What can be carried is the grant compliance that outlives whoever won the grant, the capital documentation an auditor will ask for, and the scheduling logistics around a certification you already made.
The daily service is unforgiving and visible. A vehicle that does not arrive is a person late for a shift, and the public judges the authority entirely on that — not on the capital programme, not on the grant compliance, not on the state of good repair backlog.
The capital programme runs on a different clock entirely. Planning, environmental review, design, procurement, construction and closeout stretch across administrations, and the conditions attached to the money that funds it were agreed by people who have since retired.
Those grant conditions are the quiet risk. Reporting obligations, procurement requirements, wage and domestic-content provisions, disadvantaged business participation, environmental commitments, and useful-life obligations on assets bought with federal money — each attaching to a specific asset or project, each surviving for years, and each enforceable long after the project team dispersed.
Paratransit sits between the two and is the hardest thing the authority does. Eligibility is a civil right determined case by case, trips must be scheduled within a window, the population is by definition the least able to absorb a failure, and the cost per trip is a multiple of fixed route.
And the asset picture is never current. What was bought, when, with which money, what its useful life is, when it was last inspected and whether it still meets the condition it was funded under — that lives across a maintenance system, a finance system, a grant file and somebody’s spreadsheet.
Grant conditions attach to specific assets and projects and remain enforceable for years, while the record of what was agreed lives in files nobody inherits — so an authority learns what it committed to when an auditor asks.
That is the failure that costs real money, and it is not caused by carelessness. It is caused by a handoff that never happens: a project team wins a grant, accepts conditions, delivers the project and disperses, and the obligations continue with no owner.
The first act is an inventory that needs no authority: every open grant and every asset bought under one, with the condition attached, the obligation period, the reporting calendar, and the current state of each. Authorities are usually surprised by how many obligations are live and by how few are being tracked.
What can then be carried is the compliance band. Assembling a report from data the authority already holds. Chasing a participation figure a contractor has not submitted. Flagging an asset approaching a useful-life threshold. Confirming a required document exists before an audit asks. Reconciling the maintenance record against the grant file and reporting the difference.
Paratransit logistics is the second band, and only the logistics. Scheduling a trip your staff already certified as eligible, confirming the pickup, reminding before the window, reporting a trip that went wrong. Nothing determines eligibility, and nothing decides whether a trip may be denied.
What never moves: operations control, dispatch of an in-service vehicle, any safety-critical system, any maintenance-fitness determination, any accessibility eligibility determination, and any decision to deny a trip. The first four are safety. The last two are civil rights.
Live grant obligations nobody was tracking — measured by count of enforceable conditions found in the inventory that had no owner beforehand.
Assets approaching a useful-life threshold unnoticed — measured by count flagged with lead time, against the count previously discovered at disposal or audit.
Time to assemble a grant report — measured by elapsed hours from a report becoming due to submission, per grant.
Contractor submissions outstanding — measured by count and age of outstanding participation, wage or content figures.
Time to answer "which money bought this asset" — measured by elapsed time from an auditor request to a supported answer, timed on a real request.
Paratransit trips confirmed before the window — measured by share of certified trips confirmed with the rider before pickup, and no-show rate beside it.
Disagreements between maintenance and grant records — measured by count of assets where two of your own systems differ, reported rather than merged.
operations control, dispatch of any in-service vehicle, any safety-critical system, any maintenance-fitness or return-to-service determination, any accessibility eligibility determination, and any decision to deny or restrict a trip. The first group is safety and a dependency there has no mitigation; the last two are civil rights determined by your staff under law.
Nothing subscribes to, participates in, or is depended upon by an operations control system. The correct test is that the authority could run a full service day with this entirely offline and notice nothing, and that is an architectural exclusion rather than a scope statement.
Grant, finance, asset and maintenance systems are read through documented interfaces. The obligation inventory references those records rather than becoming a second asset register — a second answer about what a bus is and who paid for it is exactly what an auditor will find.
Paratransit scheduling works inside your own window rules and your own eligibility record. It reads a certification your staff made; it never makes or revisits one.
And rider-facing surfaces are built for the population they serve, which means an old phone, a screen reader, large text, and the languages your authority already supports — for paratransit that is not a nicety, it is the service.
Operations and safety are excluded structurally. There is no configuration in which this participates in service control, and an authority evaluating it should test that by running an exercise with it offline rather than by accepting the sentence.
Accessibility eligibility is excluded because it is a civil right determined case by case by your staff under law. A system that shaped an eligibility outcome — even by ordering, framing or prioritising — would be affecting a protected determination without accountability, and there is no efficiency that justifies it.
Rider information is sensitive in a specific way: paratransit records disclose disability. That data stays inside your tenancy, on your retention schedule, exportable by you, and is not used to train anything serving another organisation.
And on assurance: an independent SOC 2 Type II attestation is in progress and no report exists yet.
Safety’s question is whether anything could become load-bearing in service. Nothing can, and the test is an exercise with it offline rather than a statement in a document.
The grants officer’s concern is that a compliance report assembled by anybody other than them is still their signature. It is — the assembly is carried, the submission and the certification are theirs.
Civil rights review should confirm that nothing touches eligibility, including indirectly through ordering or framing. That is the exclusion most likely to erode through a well-meaning feature request, so it belongs in the written boundary rather than in an understanding.
And counsel should confirm the handling of disability-disclosing records against your state law, which is frequently stricter than the federal floor.
One completed capital project’s grant conditions and funded assets, inventoried read-only, with no operations access and no rider contact.
A closed project is the right starting point: no schedule pressure, no safety exposure, and the answer is checkable against what the closeout said. If the inventory finds live obligations nobody was tracking, that is the finding; if it finds none, the authority learns its handoffs are better than it feared.
The inventory belongs to the authority whatever happens next, and it is exactly the document the next project team should inherit and currently does not.
If it continues, the first grant covers compliance assembly on one live grant, with the operations, safety and eligibility exclusions written into the scope document rather than assumed from this page.
Agreed, and that is why operations, in-service dispatch and safety-critical systems are excluded structurally rather than scoped out. The test worth running is an exercise with this entirely offline: if a full service day is unaffected, the exclusion is real. If a vendor proposes a role in service control, the risk is not the vendor — it is that you have added a dependency without redundancy to the one process where redundancy is the discipline.
Correct, and nothing here is near it — not the determination, and not the ordering, framing or prioritising that can shape one indirectly. Your staff certify eligibility under law; what is carried is scheduling a trip already certified, inside your own window rules. That exclusion is the one most likely to erode through a reasonable-sounding feature request later, which is why it belongs in the written boundary your civil rights reviewer signs rather than in an understanding.
That may be true and the inventory on a closed project is the cheap way to confirm it rather than assume it. The specific risk is not carelessness, it is the handoff that never happens — a project team accepts conditions, delivers, disperses, and the obligations continue with no owner. If the inventory comes back showing every live obligation already has a named owner and a calendar, you have a documented answer for your board and you should not buy anything.
It does, which is why the inventory is built as a document the authority keeps and the next project team inherits, exportable without asking us. The durable artefact is the obligation record, not the arrangement that produced it. Exit terms belong in the initial scoping documents rather than a later negotiation, and a capital programme that spans administrations should assume the vendor is the shortest-lived party in the room.