Sync & import
Observation that doesn't overwrite what you own.
Scheduled pulls. Incremental sync where the source supports it. Full-state reconciliation where it doesn't. Stale-not-delete so a sync gap doesn't wipe your records. Drift policies that decide what to do when observed diverges from intent.
Run model
Each connector declares what it can sync.
Accounts, groups, entitlements, relationships — the connector manifest is the source of truth. Owlie schedules runs per job. Where the source supports change markers, incremental sync advances a checkpoint each run. Where it doesn't, full-state sync compares what was observed to what's stored. Relationship syncs wait for their prerequisite object syncs to run first — memberships don't apply ahead of the users they reference.
The four launch connectors — Google Workspace, Microsoft Entra ID, Auth0, BambooHR — are effectively full-state oriented today. The incremental path is already in the contract for sources that expose usable change markers.
Policy, per source, per object
When observed diverges from intent.
Someone adds a group membership directly in the admin console. A user is disabled outside Owlie. An entitlement disappears. Sync sees it. A configurable drift policy decides what happens next — per source, per object type. The same engine can run read-only discovery, admin-review workflows, or Owlie-led enforcement. You pick.
- Adopt
- Accept the remote change as the new desired state.
- Flag
- Record the divergence and surface it for admin review.
- Preserve
- Keep Owlie's intent and request downstream reconciliation.
- Ignore
- Treat the divergence as noise for this source and object.
Drift detected — observed vs desired with policy decision
Real admin UI: observed value, desired value, a policy chip (Adopt / Flag / Preserve / Ignore), and an operator action.
Safety rail
A sync gap is not a delete event.
When a provisioned account stops being observed — a filtered run, a connector hiccup, a rate-limited page — Owlie marks the record stale rather than deleting it. The signal surfaces in admin views. Provisioned records survive sync gaps. Sync-only objects that disappeared remotely are soft-deleted on authoritative full runs, never on filtered or truncated ones.
Keep going.
Governance model
The four objects Owlie reasons over, and how sync fits inside the graph.
Provisioning
Intent-based, versioned, same pipeline for every fulfillment path.
Standards
SCIM, SAML 2.0, OIDC. The standards side of integration.
Request Early Access
Bring a real connector question. We'll walk it through sync, drift, and reconciliation.
Sync that observes instead of overwriting.
Early access is open. Bring a real drift scenario and we'll show you how the policy engine handles it.