Joiner / mover / leaver
Three lifecycle events. One pipeline.
New hires onboard in cohorts. People change roles. People leave. Owlie runs all three through the same request-to-fulfillment-to-evidence pipeline — so joiner cohorts don't break on Monday and leaver sweeps don't leave dangling access.
JML pipeline — joiner / mover / leaver states in one feed
The three transitions
Same pipeline. Three shapes of change.
Joiner.
HR signals a new hire — from your HRIS (BambooHR and Workday supported natively at launch; builder workflow for other HRIS providers). Owlie creates the identity, evaluates the joiner policy (role-based bundles, location-based exceptions), provisions the standard resources, opens tickets for anything that requires manual fulfillment, and notifies the manager. Provisioning can be scheduled to a future start date, so access is typically ready well before the first day.
Joiner — cohort bundles + manager notification
Mover.
Role changes, team transfers, or attribute updates trigger delta evaluation. Owlie computes what should change: add new entitlements, remove no-longer-needed ones, transition entitlement assignments without fully revoking access. Existing resource approval policies still apply to any additional access a move requires.
Mover — delta view of add / remove / transition
Leaver.
Termination or voluntary exit triggers revocation across every connected system. Where you want a staged exit, a single revoke can unfold on the timeline you declare — disable now, archive later, delete on schedule — from one authored profile. Sync confirms each revocation actually happened. Evidence is captured at every step. Manual fulfillment — for the systems you can't automate — generates tickets with the specific instructions needed.
Leaver — revocations journal with sync confirmation
Why JML is a mess in most tools.
Most IGA and access tools treat joiner, mover, and leaver as three different workflows with three different audit stories. That's how you end up with "we provisioned the new hire through the connector but the badge access went through a manual ticket that nobody closed" scenarios. Owlie unifies them through the same Resource + approval + fulfillment + evidence model — so the JML story is one story.
What you configure vs. what Owlie does.
You configure
The role-based bundles. The resource approval policies movers still have to satisfy. The leaver destinations — which systems revoke automatically, which generate tickets.
Owlie does
The state transitions. The versioned provisioning. The sync verification. The journal. Every transition is deterministic and idempotent — so retries don't double-apply and failures don't lose state.
JML, one pipeline, no dangling access.
Early access is open. Bring your messiest lifecycle flow and we'll show you how Owlie runs it.