A model your auditors and your engineers both recognize.

The shape

Four objects. One shared graph.

Four first-class objects record who has access, why, when it began, who granted it, and which policy applies.

Composition

A Resource can be made of other Resources.

If a Resource is anything your business grants access to, then the standard engineering kit is a Resource too — the repo, the CI seat, the staging role, the laptop. Compose it once as a bundle and a new engineer asks for one thing instead of five. On approval it expands into a child request per component, and no component asks for its own approval; the decision was made at the bundle. Policy still runs per component before anything expands, and a component your policy blocks stops the expansion rather than delivering a partial kit. The contents belong to the administrator who composed them, not to whoever is asking — and if the composition changes while a request is in flight, delivery fails rather than quietly granting a different kit.

Each component then provisions on its own path and keeps its own status; the parent carries the aggregate outcome. The person who asked sees one bundle in their access list, collapsible, with every component’s real lifecycle underneath, including any failed components. Where a bundle was granted first and ratified after, a rejection revokes each delivered component individually and fences off the ones that never started.

Source of truth

Every attribute has a rule, and the rule wins.

Identity attributes carry per-attribute source-of-truth rules. Email might prefer Workday and fall back to Google Workspace; a value asserted by any other system is recorded as a claim but never wins resolution. Title might come from a single authoritative HR source. Custom attributes your tenant defines under its own namespace run through the same precedence machinery as the built-in ones. Owlie resolves the winning value per attribute against the rule you configured, so the value you see matches it.

Downstream truth

The winning value reaches the target in the target’s own language.

A manager isn’t a name. To Active Directory it’s a distinguished name; to Microsoft Entra ID it’s an object id. Owlie maps manager and other identity-reference attributes to the relationship, then writes each target’s native identifier when it provisions the account. Onboard a batch where a report provisions before their manager’s account exists, and the reference defers and backfills on its own once that account lands — so accounts provision in any order, across systems, and the links converge without dependency ordering. Active Directory’s manager mapping ships as a default; the same mechanism is open to any connector attribute that declares itself a reference.

Mark a mapping to keep in sync and a later change to title, department, or manager is re-evaluated and pushed to the already-provisioned account as a scoped attribute update — no full re-provision, no per-connector drift code. It stays opt-in per attribute, so create-only values and generated usernames don’t drift. This lets changes in HR reach the target app for the attributes you select.