Onboarding Operators and Pilots

Andi Lamprecht ·2026-05-11· 7 min read· Draft

1. Operator Registration

An operator is a legal entity responsible for flight operations under regulations such as FAA Part 91, Part 135, or Part 137. Registration produces an Operator Org Certificate — annual, revocable, chained under the Operator Credentialing CA.

2. Pilot Enrollment

A pilot is an individual human who carries direct regulatory responsibility for a flight. In the ATOMx organization model, a pilot is the sole member of a single-person org of type Pilot and is affiliated with one or more operators.

    sequenceDiagram
    autonumber
    participant Op as Operator Org
    participant ATOMx
    participant Pilot as Pilot User
    Op->>ATOMx: Invite pilot user
    Pilot->>ATOMx: Identity proofing (login.gov / PIV / passport-grade KYC)
    ATOMx->>ATOMx: Verify training, medical, FTN against IACRA
    ATOMx-->>Pilot: Pilot Certificate
    Pilot->>Op: Accept affiliation
    Op->>ATOMx: Confirm pilot-to-operator affiliation
    ATOMx->>ATOMx: Record signed affiliation in audit ledger
  

Identity proofing channels

Pilot identity is proven through one of the channels documented in Pilot Identity §5. The trust ladder cell the pilot ultimately occupies depends on the channel — login.gov / PIV / CAC reach Strongly Verified; FTN-only is Weakly Verified and must be paired with a stronger channel for any flight that targets L4 or L5.

What the pilot certificate proves

The Pilot Certificate is annual, revocable, and bound to the individual — not to the operator the pilot is currently affiliated with. The pilot’s regulatory responsibility travels with the pilot.

3. Pilot-to-Operator Affiliation

A pilot is always affiliated with one or more operators. The pilot org is the unit of personal responsibility; the operator org is the unit of organizational responsibility. ATOMx will not issue an authorization for a pilot who is not currently affiliated with an active operator unless the pilot’s regulatory category permits self-operation (e.g., Part 107).

The affiliation event is signed by both parties (the operator and the pilot) and recorded in the ATOMx audit ledger. Revoking the affiliation is also a signed event.

4. Aircraft Binding

Once an operator is registered and pilots are enrolled, the operator binds airframe serials to its org and grants pilots operating rights to specific airframes. This is the bridge into the aircraft lifecycle — see Onboarding Aircraft §4 and §5.

5. Operating-Category Distinctions

The operating category an operator is registered under shapes onboarding and ongoing requirements. ATOMx does not invent these distinctions — they reflect existing FAA structure — but the operator profile carries them so authorization workflows can apply the right rules.

5.1 Sole-Proprietor and Single-Person Operations

When the same individual is the legal entity and the only pilot, the Pilot org and Operator org collapse into a single single-person operator profile. ATOMx records both org-types under one user, with internal references that preserve the distinction (the audit ledger still treats org-level decisions as operator events and individual flight responsibility as pilot events).

5.2 Autonomous Aircraft and the RPIC Question

Some operations are autonomous to the point that no human is at the controls during the flight — but FAA still requires a designated Remote Pilot in Command (RPIC) who is regulatorily responsible. ATOMx models this by allowing the pilot identity bound into an Authorization Package to be the RPIC, even if no human input is happening during flight. The pilot identity is the responsibility carrier, not necessarily the active operator.

For fully-autonomous future operations under Part 108, ATOMx may bind an operator-system identity (a software actor with its own credentials) instead of a human pilot, with a human RPIC named at the operator level. The substrate for this is in place; the regulatory path is not yet finalized.

5.3 Multi-Affiliation and Conflict Resolution

A pilot affiliated with multiple operators may submit flight plans under any of them. Conflicts (two operators trying to assign the same pilot to overlapping flights) are surfaced at submission; the pilot accepts one and rejects the other. ATOMx does not silently prefer one operator’s claim.

6. Renewal and Revocation

7. Cross-References

• The non-repudiation properties of pilot identity: Pilot Identity §4
• How operator and pilot identities are bound into a flight: Authorization Package
• The org-type model this fits into: Disconnected Operations §2.1

Implementation Readiness — Open Questions

Each entry below identifies a decision not yet locked. Items marked (ADR) should be formalized as an Architecture Decision Record before implementation begins. Items marked (blocking) must be resolved before the relevant feature can be built.