An aircraft operator security program where every TSA directive reaches every station, in place and proven
Every Security Directive in place at every station before it takes effect, and proven.
See one case, screen by screen ↓Aircraft Operator Security Program is software that puts each TSA Security Directive into an airline's aircraft operator security program — the 49 CFR 1544 security program TSA approves — and into its stations and its training. Seven agents read the directive, draft the program redlines, each station's action list and the training plan, check the station evidence and keep the directive to people with a need to know. The security coordinator approves the rollout, each station manager confirms their own station, and the Director signs.
How to choose AI for airlines: a buyer's guide to agentic AI solutions →
Updated
Under 49 CFR 1544.305, every Security Directive that reaches an aircraft operator security program starts the same clocks: acknowledge receipt to TSA within the time it sets, report how each measure will be implemented, put the measures in place by TSA's date at every station they apply to, and keep the directive to people with a need to know. The Aircraft Operator Security Coordinator does that by hand today. The directive lands in a secure mailbox, the coordinator works out which program sections and station procedures it changes, emails each station security manager, asks the training team who needs a briefing, and chases attestations in a spreadsheet.
One directive lands in many places: in the demo, 4 program sections, 9 station procedures, 1 training module and 1,148 people with cargo-area access. Done by email, each station reads it alone, and a local procedure that contradicts it survives until an inspector finds it. Training lists are blunt, so teams retrain everyone or miss contractors who hold badges but are not on the roster. And when the Principal Security Inspector asks, the evidence is rebuilt from email, door-log photos and the LMS.
Estimated split for one Security Directive that reaches nine stations, by hand and with the solution.
Seven agents read each directive, fan it out into the program, the stations and the people, check each other and keep the evidence; the security coordinator approves the rollout.
On Tuesday at 16:40 CT, a cargo directive — SD 1544-26-07, Cargo area access and chain of custody, fictional and written for this demo — reaches Corvane Airways' security mailbox. It applies to nine Corvane stations. Here is what happens next in the aircraft operator security program, screen by screen, in the working solution.
Claire's morning opens on 14 directives and amendments in force, 11 of 11 acknowledged on time this year, and four things that need her. The security agent's briefing sits beside them: one directive needs her decision today, the rollout is drafted, and the check agent found a Miami procedure that contradicts it. Below, every step the agents took since Tuesday, with the time.
Security agent: “The report to TSA is due Tue, Oct 20. A measure missed can cost $42,657 per violation.”
The directive opens as one plain sentence: TSA wants every entry to a cargo area verified and logged, and every built-up cargo unit sealed until it reaches the aircraft, at nine of Corvane's US stations. Six requirements follow, each with a numbered citation to its paragraph. Four clocks run across the top: acknowledged Tue 17:05, 25 minutes after receipt; method to TSA by Tue, Oct 20; measures in place by Mon, Nov 16; training complete by Mon, Nov 30.
The program agent mapped the six requirements to four program sections and nine station procedures and drafted four redlines into draft revision 32. For §4.3 Cargo area access, revision 31 in force sits beside the proposed text: escort at no more than three persons per escort, identity and authorization checked against the station access list, every entry recorded. Its confidence is 0.94; §4.6 sits lowest, at 0.88, because the directive does not say where the seal number is recorded, and the program agent chose the load sheet for Claire to confirm.
Check agent: “I read R3 on my own and reach the same text.”
The check agent read the directive without seeing the first mapping and agrees on 5 of 6. Miami's procedure S-MIA §3.2 still lets the duty supervisor authorize cargo-area entry by radio and record it at shift end, which R3 does not allow. It drafted the fix: retire §3.2, and when a reader is down a guard verifies at the door and logs the entry. In Houston, Brightwing Cargo handles Corvane's cargo under its own TSA program, so the station agent asks Claire to accept that exception and request their written confirmation.
The rule “the check agent must agree” holds the rollout until Claire decides.
Claire asks whether Corvane is ready if TSA inspects Newark tomorrow. The evidence agent answers with its sources: not yet for this directive, because its measures are due at EWR on Nov 2, and the August finding on cargo door access is still open. R1 and R6 evidence is ready, and it builds the pack as stations confirm.
Claire accepts Miami's fix, then approves the rollout as the security agent proposed it: BOS and EWR by Mon, Nov 2, because EWR has an open TSA finding and an inspection the week of Nov 9 and BOS has six cargo doors without entry logging; the other seven stations by Mon, Nov 16. In the same dialog she accepts Brightwing's program for R3–R4 at Houston, with their letter due Mon, Nov 9, picks reason code D1 · Approve as drafted and signs electronically.
“On approval: 9 station managers each get only their own SSI-marked list (31 actions), sessions for 212 people go to Mei Lindqvist, and the report to TSA waits for you to send.”
The agents roll it out step by step: each station's list sent, sessions for 212 people proposed to the training manager, revision 32 opened with the four redlines, the EWR inspection pack opened. The implementation report is drafted measure by measure — method, where and by when, program section — SSI-marked for Corvane's Principal Security Inspector. Claire sends it herself and records it with “I sent it to the inspector”.
The agents never contact TSA.
Luis sees only Boston's four actions, each with its due date and the evidence it needs, and confirms each one himself. He uploads the cargo door entry log: five photos. The check agent reads it against the requirement and sends it back — the log has pages for doors C1–C5, but S-BOS lists six doors. Luis is asked to add the C6 page and confirm again, weeks before an inspector would ask.
Check agent: “I sent the door log back: it has pages for C1–C5, but S-BOS lists 6 doors.”
Of 1,148 people with unescorted cargo-area access, 936 already have a recurrent session before Nov 30, and the training agent added the CS-04 rev 7 briefing to those. 212 do not, each listed with the reason — next recurrent in January, hired in September, returning from leave — and a proposed session. Nine Tamberlane Ground Services staff at EWR hold cargo badges but are on no training roster.
For TSA's comprehensive inspection at EWR the week of Nov 9, the evidence agent builds the pack by requirement, SSI-marked, for the Principal Security Inspector: the acknowledgment record and need-to-know list and access log already in, every item still to come listed against the station action that will produce it. Every other directive in force shows its stations confirmed and where its evidence stands.
Evidence agent: “I keep the evidence by requirement, so the pack for any station is built in a minute.”
The same Security Directive, seen by five of the people who put it in place — what their weeks looked like, and what they look like now.
Seven agents read each directive, fan it out into the program, the stations and the people, check each other and keep the evidence; the security coordinator approves the rollout.
Watches the security mailbox for Security Directives, emergency and national amendments and information circulars; logs receipt, starts the clocks and pages the coordinator.
Reads each directive, writes the plain summary with every requirement quoted, fans it out into program, stations and people, and drafts the rollout plan and the implementation report to TSA.
Maps each requirement to the program sections and station procedures it changes and drafts the redlines, with a confidence on each.
Builds each station's own action list, sends it SSI-marked, reminds before the phase date and escalates to the Director after a missed one.
Finds who will not be trained by the deadline from the training system, the badge system and the HR roster, and proposes sessions.
Reads each directive blind and compares; checks station procedures and every piece of station evidence against its requirement.
Keeps the need-to-know list per directive, checks SSI marking and shares, logs every opening and builds the inspection pack by requirement.
Approves every rollout and redline; each station manager confirms their own station; the Director signs the report. The agents propose; a named person decides.
Ask about a directive, a station or a person, or tell the agents what to do. Every answer points to its source, and nothing is approved, sent or shared until a person says so.
Why BOS and EWR first?
EWR has an open TSA finding from August: a cargo door propped open and people entering without verification — the measure R3 now requires — and TSA inspects EWR the week of Nov 9. BOS has 6 cargo doors that do not record individual entries. Both by Nov 2 gives a week of evidence before the inspection.
Why 212 and not all 1,148?
936 of the 1,148 badge holders already have a CS-04 recurrent session on or before Nov 30; the rev 7 briefing is added to each of those sessions. The directive asks for training before Nov 30, not a new course for everyone. The other 212 have no session in time.
What happens if a station misses Nov 16?
Each missed measure is a violation: up to $42,657 each and $1.2 million per action. If a station cannot make the date, Corvane may propose an alternative measure to the Principal Security Inspector within the 7 days in paragraph B; the security agent drafts it, and the coordinator decides whether to send it.
Can a contractor supervisor see the directive?
A contractor may be a covered person with a need to know, but only for what their duty needs. For Tamberlane at EWR that is the EWR station action list, not the whole directive and the other 8 stations.
13 screens from the working solution, on its sample data. Pick one to see it large.
The clocks, thresholds and evidence rules the agents follow are settings. A change takes effect when the Director approves it, and it goes on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Alert before an acknowledgment window closes | 2 hours | Hours before the window closes |
| Mapping confidence below which a person must review | 0.85 | A threshold between 0 and 1 |
| The check agent must agree before a rollout is approved | On | On · Off |
| Station confirmations due before the phase date | 3 business days | Business days before the phase date |
| Escalate to the Director after a missed date | 1 business day | Business days after the date |
| Training reminders | 14, 7 and 2 days before | Days before the session is due |
| Door logs must cover every listed door · photos need a date stamp | On | On · Off |
| Deny SSI outside the need-to-know list unless a person grants it | On | On · Off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (49 CFR 1503.401, TSA technical amendment published Dec 29, 2025 — up to $42,657 per violation and $1.2 million per civil penalty action). Rules named: 49 CFR 1544.101, 1544.215, 1544.235 and 1544.305; 49 CFR Part 1520. SD 1544-26-07, Corvane Airways, its contractors and partners, and the people named on this page are fictional — characters and sample data in the working solution.
Aircraft Operator Security Program is software that puts each TSA Security Directive into an airline's aircraft operator security program — the 49 CFR 1544 security program TSA approves — and into its stations and its training. Seven agents read the directive, draft the program redlines, each station's action list and the training plan, check the station evidence and keep the directive to people with a need to know. The security coordinator approves the rollout, each station manager confirms their own station, and the Director signs.
It tracks what 49 CFR 1544.305 Security Directives require: the acknowledgment clock, the implementation report, the date measures must be in place at every station, and training. The security agent drafts the rollout and the implementation report, the station agent chases each station's confirmation, and the evidence agent keeps the proof by requirement.
No. The intake agent logs receipt and starts the clocks, and the coordinator records the acknowledgment. The implementation report is drafted for the coordinator, who sends it and records the send. No agent ever contacts TSA.
The training agent compares the badge system, the HR roster and the sessions already booked. In the demo, 936 of 1,148 badge holders already had a session in time and get the briefing added; 212 need one, and 9 contractor staff at Newark hold badges but are on no training roster.
Each directive has its own need-to-know list, and each station gets only its own extract. The evidence agent recommends on every access request and a person decides; every document is checked for its SSI marking under 49 CFR Part 1520, and every opening is logged.
It keeps the evidence for every directive by requirement — acknowledgment records, entry logs, seal counts, training records, the need-to-know list and access log — and builds an SSI-marked pack for a station in one step. You can rehearse the inspector's likely questions with the evidence agent.
Yes. The agents draft, check and recommend. The coordinator approves every rollout and redline with a reason code and e-signature, only a station's own manager confirms for it, the Director signs the monthly status report and Corvane's comments to TSA, and a disagreement from the check agent holds the rollout until a person decides.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your security program, station procedures, rosters and a past directive — and it goes live once every quality gate has passed. We will walk you through it on your own program first.
Every report routed the same day, every repeat linked before it is scored.
1-min demoAviation Safety Action Program (ASAP)Every ASAP report ready before the ERC meets, every action tracked to closure.
1-min demoSafety Investigation ManagementReports drafted in days, not weeks, with every finding tied to its evidence.
1-min demoWe'll run Aircraft Operator Security Program on your own security program, stations and a past directive.