Lifecycle state and overrides

Lifecycle state describes an identity's employment stage in terms Owlie policies can use. Rules turn source attributes into values such as HIRED or TERMINATED, so policies do not need to handle each HR system's status names separately.

Lifecycle state is separate from Owlie Status. Lifecycle state can drive access policy; Owlie Status controls whether the person can use their Owlie account. An identity can therefore show a non-terminated lifecycle state while its Owlie account remains disabled.

From source data to lifecycle state

Identity Sync first maps source fields into identity attributes. Owlie then evaluates the tenant's ordered lifecycle rules against those resolved attributes. The first matching rule supplies the derived lifecycle state; if no rule matches, Owlie uses the configured fallback.

Diagram placeholder: Show a left-to-right normalization flow: raw HR status values from two fictional sources → resolved employment_status attribute → ordered lifecycle rules → one effective lifecycle state → JML and access policies. The visual must distinguish source values from Owlie lifecycle values and label the first-match/fallback decision.

For example, one HR source might send HIRED, TERMINATED, or ONLEAVE, while another sends different strings for the same business conditions. Those are illustrative source values, not fixed Owlie lifecycle states. Map the incoming value to an identity attribute, then define lifecycle rules that express your organization's meaning. Do not assume that ONLEAVE should become a particular lifecycle state: leave handling is a policy decision.

New organizations start with these lifecycle rules:

Resolved identity attribute	Derived lifecycle state
employment_status is ACTIVE	HIRED
employment_status is TERMINATED	TERMINATED
No rule matches	UNKNOWN

Rules are evaluated in their configured order. Organizations can edit the rules and add lifecycle values, so the choices shown for an identity may extend beyond HIRED, TERMINATED, and UNKNOWN. Use source priority to control which source wins when several systems contribute the input attribute.

How policies use the normalized state

Grant and deny policies can select identities by lifecycle state. When that state changes, Owlie evaluates the applicable policies again.

Configure policies to grant or remove access for each state, then check that provisioning completes. Mapping a leave status, for example, does not suspend access unless a policy requires it.

Entering TERMINATED immediately disables the identity's Owlie account. Access removal in other systems depends on lifecycle policies. Changing the state or returning to automatic derivation does not re-enable the Owlie account; you must restore account access separately.

Temporarily override an identity

Use a manual override when the derived value is temporarily wrong or an urgent lifecycle decision must take effect before a source is corrected. You need the identity.lifecycle.manage permission.

1. Open the identity in Admin > Directory.
2. Open the identity actions menu. Select Emergency Termination when the current state is not TERMINATED, or Set Lifecycle State when it is. Both actions open the same editor; the emergency action starts with TERMINATED selected.
3. In Set lifecycle state, choose one of the configured lifecycle values.
4. Enter a Reason. Owlie requires it and records it with the override for audit and operator context.
5. Select Save lifecycle state. Choosing TERMINATED requires a second confirmation with Terminate now because it immediately disables the Owlie account.

The manual value becomes the effective lifecycle state and takes precedence over the derived value. Source sync and derivation continue underneath, but they do not replace the override.

Return to automatic derivation

Correct the source data or lifecycle rules before clearing an override. Otherwise the same incorrect derived value takes effect again.

Open the lifecycle editor, choose Automatic (derived), enter a reason, and save. Owlie removes the override and immediately uses the current derived state, without waiting for the next Sync.

Check both badges on the identity afterward:

• Lifecycle State should show the value selected by the current lifecycle rules.
• Owlie Status remains independent. If a prior termination disabled it, returning to automatic does not make it active again.