Joiner / mover / leaver
Three lifecycle events. One pipeline.
New hires onboard in cohorts. People change roles. People leave. Owlie runs all three through the same request-to-fulfillment-to-evidence pipeline — so joiner cohorts don't break on Monday and leaver sweeps don't leave dangling access.
JML pipeline — joiner / mover / leaver states in one feed
The three transitions
Same pipeline. Three shapes of change.
Joiner.
HR signals a new hire — from your HRIS (BambooHR at launch; builder workflow for others). Owlie creates the identity, evaluates the joiner policy (role-based bundles, location-based exceptions), provisions the standard resources, opens tickets for anything that requires manual fulfillment, and notifies the manager. The new hire sees their access ready when they first log in.
Joiner — cohort bundles + manager notification
Mover.
Role changes, team transfers, or attribute updates trigger delta evaluation. Owlie computes what should change: add new entitlements, remove no-longer-needed ones, transition entitlement assignments without fully revoking access. Move-specific approval policies apply where they exist.
Mover — delta view of add / remove / transition
Leaver.
Termination or voluntary exit triggers revocation across every connected system. Sync confirms each revocation actually happened. Evidence is captured at every step. Manual fulfillment — for the systems you can't automate — generates tickets with the specific instructions needed.
Leaver — revocations journal with sync confirmation
Why JML is a mess in most tools.
Most IGA and access tools treat joiner, mover, and leaver as three different workflows with three different audit stories. That's how you end up with "we provisioned the new hire through the connector but the badge access went through a manual ticket that nobody closed" scenarios. Owlie unifies them through the same Resource + approval + fulfillment + evidence model — so the JML story is one story.
What you configure vs. what Owlie does.
You configure
The role-based bundles. The mover-specific approval policies. The leaver destinations — which systems revoke automatically, which generate tickets.
Owlie does
The state transitions. The versioned provisioning. The sync verification. The journal. Every transition is deterministic and idempotent — so retries don't double-apply and failures don't lose state.
JML, one pipeline, no dangling access.
Early access is open. Bring your messiest lifecycle flow and we'll show you how Owlie runs it.