Sync & import
Observation that doesn't overwrite what you own.
Scheduled pulls. Incremental sync where the source supports it. Full-state reconciliation where it doesn't. Stale-not-delete so a sync gap doesn't wipe your records. Drift policies that decide what to do when observed diverges from intent.
Run model
Each connector declares what it can sync.
Accounts, groups, entitlements, relationships — the connector manifest is the source of truth. Owlie schedules runs per job. Where the source supports change markers, incremental sync advances a checkpoint each run. Where it doesn't, full-state sync compares what was observed to what's stored. Relationship syncs wait for their prerequisite object syncs to run first — memberships don't apply ahead of the users they reference.
Incremental is shipped, not just contractual. Active Directory advances on uSNChanged and Generic LDAP on modifyTimestamp; Generic Database, Salesforce, OneDrive, and Linear read their own change markers today. Sources that expose no usable marker run full-state instead — the choice is declared per connector in its manifest, not a platform-wide default.
Policy, per source, per object
When observed diverges from intent.
Someone adds a group membership directly in the admin console. A user is disabled outside Owlie. An entitlement disappears. Sync sees it. A configurable drift policy decides what happens next — per source, per object type. The same engine can run read-only discovery, admin-review workflows, or Owlie-led enforcement. You pick.
- Adopt
- Accept the remote change as the new desired state.
- Flag
- Record the divergence and surface it for admin review.
- Preserve
- Keep Owlie's intent and request downstream reconciliation.
- Ignore
- Treat the divergence as noise for this source and object.
Drift detected — observed vs desired with policy decision
Composite of existing dash views: observed vs. desired from the sync run inspector, the drift policy chip (Adopt / Flag / Preserve / Ignore) from behavior config, and an operator action (Approve / Reject) from the adoptions queue.
Safety rail
A sync gap is not a delete event.
When a provisioned account stops being observed — a filtered run, a connector hiccup, a rate-limited page — Owlie marks the record stale rather than deleting it. The signal surfaces in admin views. Provisioned records survive sync gaps. Sync-only objects that disappeared remotely are soft-deleted on authoritative full runs, never on filtered or truncated ones.
Keep going.
Governance model
The four objects Owlie reasons over, and how sync fits inside the graph.
Provisioning
Intent-based, versioned, same pipeline for every fulfillment path.
Standards
SCIM, OIDC. The standards side of integration.
Request Early Access
Bring a real connector question. We'll walk it through sync, drift, and reconciliation.
Sync that observes instead of overwriting.
Early access is open. Bring a real drift scenario and we'll show you how the policy engine handles it.