Your manifest says who was expected to move before the border closed. It does not say who can move now. Colleagues in the same office may face different outcomes. A destination national, temporary resident and an accompanying family member can each carry a different case.

The route list carries the same false comfort. Nominally separate itineraries may still depend on the same transit state, document interpretation or closed airspace. A seat remains irrelevant when the passenger cannot lawfully reach it, board it or enter at the other end.

Rebuild the population as crossing cases. Country presence fails because border controls act on people and required movements. ISO 31030:2021 covers risk to organisations and their travellers, but the live record needs more precision than “employee in country.”

Give each person one row for each required movement. Record organisational relationship, nationality or nationalities, residence or visa status, direction, transit states, crossing point, mode, earliest departure and latest acceptable crossing time. Link accompanying people whose position constrains the movement. Include planned arrivals, commuters, contractors and people on leave when they have a required crossing.

Direction belongs in the case. General Comment 27 (1999) distinguishes an alien’s lawful entry, everyone’s freedom to leave and entry to one’s own country under Article 12. A person who can enter as a national may still face an exit restriction. A visitor who can leave may lose the right to return.

Run three pass or fail tests. A single “cleared” field hides three different authorities. The state decides admissibility. The carrier decides whether it will accept the person. The operation decides whether physical capacity exists before the deadline. Keep the result, evidence, checker and check time for each gate.

Test state admissibility first. Read the rule against the person’s direction, purpose, status, documents, transit and health conditions. Under the EU Visa Code, Article 34 separates revocation from a missing supporting document. International Health Regulations (2005) Articles 23 and 31 permit defined health-document review and specified entry conditions. “Valid visa” therefore cannot serve as a complete answer.

Test carrier acceptance again. Under the Schengen regime, Article 26 creates covered carrier document-check duties, while Directive 2001/51/EC extends return responsibilities and harmonises penalties. A legal opinion may be correct and still fail at check-in because the carrier cannot recognise the exception in time.

Then test usable capacity. Count seats or vehicle places only after the first two gates pass. Include feeder space, crossing throughput, loading, medical carriage, crew time, unloading and receiver capacity. A large aircraft does not rescue a movement whose land feeder or reception desk can accept fewer people.

Put a clock on every result. A closure turns a correct answer into stale evidence quickly. As of 27 August 2026, IATA said Timatic checked documents for more than 700 million passengers each year through over 2,000 officials, while requirements could change up to 200 times daily. Those vendor figures explain why your carrier result needs an “as of” time.

Set the next check from the crossing deadline and the source’s likely decay. A person is movable only while all three gates remain passed for the same route and window. Unknown cases stay in the denominator. They do not disappear into a note beneath the manifest.

Keep people and groups visible at once. A family label fails because it obscures the individual who causes the constraint. Separate rows preserve identity, admissibility, medical needs and welfare responsibility. A group link shows whether the authorised policy permits separation.

When the household will remain together, the group inherits its tightest failed gate. Keep every dependant in the population denominator, then report employees and dependants separately. NATO doctrine seeks to maintain family integrity where possible. That operating preference creates handling consequences; it does not erase individual status.

Add dependency concentration. Count how many required movers rely on the same exemption, crossing, carrier interpretation or transit state. Count each critical role once and mark whether an in-country substitute exists. Repeated bookings for one specialist still represent one exposed role.

Resolve entitlement before collection. Assembly fails when a marshal must decide employment, family or immigration policy beside a waiting vehicle. Publish who is entitled, the dependant rule, acceptable identity evidence, baggage and medical conditions, and the official who can decide an exception.

Keep eligibility separate from border admissibility. A person may qualify for your movement and fail the state’s entry test. Another may be admissible but outside your authorised population. Return accepted, deferred or refused to the main flow, with the reason and remaining assistance recorded.

This decision must precede the queue. UK JDP 3-51 identifies processing as a potential choke point and divides an evacuation handling centre into three functional areas: reception, registration and medical processing, and holding. The functions remain even when one site performs all three.

Authorise one executable variant. A list of alternatives invites another approval round when the primary route fails. Select one variant and record its population, origin, safer destination, mode, earliest movement time, deadline, authoriser and receiver. Separate authority to prepare from authority to move.

Record observable change conditions beside it. “The eastern crossing closes to civilian traffic” moves the case to the authorised western route. “The airline rejects the documented exception” moves eligible passengers to surface transport. “Reception withdraws medical acceptance” holds that case for another receiver. UK doctrine warns that planning, ministerial consideration and directive issue can run from hours to weeks, so delegated change authority matters.

Place the variant within a usable ladder. NATO doctrine gives four diplomatic stages: stand fast, commercial departure, commercial or official departure, and shelter in place. Name the current stage, the next trigger and the person who can change it. Cancellation instructions must reach people already travelling.

Join the four movement links. Collection capacity alone moves nobody. Confirm assembly processing, feeder transport, the crossing or line-haul movement, and destination reception as one chain. The usable throughput is the lowest accepted flow among them.

For each link, record owner, opening time, capacity, communications, acceptance condition and abort condition. Estimate platform cycles with embarkation, transit, turnaround and refuelling, as NATO doctrine requires. Open collection only after the carrier and receiver confirm the same manifest and window.

Reception opens before departure. It must accept unloading, immediate medical cases, welfare, accommodation and onward transport. UK guidance treats up to 72 hours as short-term shelter and warns that basic rest centres may not suit vulnerable people. Your receiving plan must distinguish a brief holding site from suitable accommodation.

Record the receiver’s acceptance time against the manifest.

In covered US workplaces, 29 CFR 1910.38 requires evacuation type, route assignments and trained assistants. That US rule does not decide a cross-border case. It reinforces the need to assign movement roles before people enter the chain.

Transfer every residual case by name. A failed row cannot remain under “not travelling.” That label hides whether the person is sheltering safely, awaiting evidence, separated from dependants or approaching a crossing deadline without a lawful route.

Assign one residual-case owner. Transfer the person, failed gate, evidence time, location, contact method, welfare need, next review time and alternate disposition. The disposition may be later movement, another lawful route, suitable shelter or consular referral. Give the owner authority to reopen the three tests when facts change.

Close the movement only when the receiver accepts those who arrived and a named owner accepts everyone who did not. Your manifest then becomes an executable case register. It shows who can move, on which authorised variant, before which deadline, and who owns the consequence when they cannot.