An apparatus allows workers to assert and release control over the energization of a system. The apparatus does not require the workers to carry any additional paraphernalia, and is not be easily defeated by other workers. Users asserting and releasing control present tokens uniquely identifying each user to a reader, and the apparatus prevents transition of the system to an undesired state until an appropriate number of users are currently asserting control. For example, a dangerous manufacturing robot can be prevented from energizing until all the users that have asserted control when entering the robot's controlled space have subsequently released control when leaving the robot's controlled space.