The Owlie model
An identity has assigned resources. Each assigned resource is an instance of a resource: the resource describes what you offer; the assigned resource records that offering for one identity.
Identity ── has ── Assigned resource ── instance of ── Resource
Alex Rivera Alex's workspace access Engineering workspace
Diagram placeholder: The core model. Replace this text diagram with a simple visual showing Identity → Assigned resource → Resource, retaining the relationship labels and example.
For connected systems, an assigned resource can link to an account and its entitlements. Owlie calls entitlements Grants.
Resource versus assigned resource
A resource is something your organization makes available, such as an application account, workspace access, or a manually fulfilled item. It describes how people request it, who approves it, and how it is fulfilled. You configure those rules once on the resource.
An assigned resource belongs to one identity. It tracks that identity's assignment, including its status and any access window. If Alex and Sam both receive Engineering workspace access, they have separate assigned resources based on the same resource.
| Object | In this example | What it tells you |
|---|---|---|
| Identity | Alex Rivera | Who the assignment belongs to. |
| Resource | Engineering workspace | What is offered and how requests and fulfillment are configured. |
| Assigned resource | Alex's Engineering workspace assignment | The state of this particular assignment. |
Check the assigned resource's state to see whether fulfillment has finished. It can be scheduled, pending provisioning, provisioned, disabled, or revoked. Its presence alone does not mean someone can sign in.
Accounts and entitlements
An account is an identity's representation in a connected system. Alex's Owlie identity and Alex's workspace account are different objects. One identity can be linked to accounts in several systems.
A connector-backed assigned resource can link to the account it manages. A manually fulfilled resource does not need a linked account.
Entitlements describe access within a system: for example, membership in an Engineering group or permission to edit a folder. In Owlie, each such assignment is a Grant.
Alex's identity
└── Assigned resource: Engineering workspace
└── Linked account: Alex's workspace account
├── Grant: member of the Engineering group
└── Grant: editor of the Design folder
Alex's account gives them a presence in the workspace. Their Grants describe which groups, folders, and other targets they can access. The available kinds of Grant depend on the connector and the connected system.
Grants are not limited to accounts: a group can hold access that its members inherit. Nor must every Grant have been requested through an Owlie resource. Sync can discover access already present in a connected system. The unified access model develops these relationships, including inheritance and the details that distinguish one Grant from another.
Requested, intended, and observed access
Owlie tracks requests, desired access, and observations separately:
- A request records an attempt to obtain access and its approval process. Approval does not establish that fulfillment succeeded.
- Desired access describes what Owlie intends an identity to have. Policies and approved requests can contribute reasons for that access.
- Observed access describes what Sync found in the connected system. It can include access created outside Owlie.
Provisioning applies changes; Sync reads the result from the target. Check both the operation and the latest Sync to confirm access. If Sync could not read all the relevant records, a missing observation does not prove that access is absent.
Access can have more than one reason to exist. For example, a request and a policy can support the same Grant. Ending one reason does not necessarily remove access while another still applies.
Tasks and Bundles
The example above uses a normal assignable resource. Owlie also has two other resource types:
- A Task represents work to execute, rather than ongoing access to hold. It is repeatable; its history tracks executions, not a continuing account or Grant relationship.
- A Bundle groups component resources into one offering. Fulfillment expands the Bundle into its components; the Bundle itself is not another account to provision.
Start with an assignable resource when defining ongoing access. Use Tasks for work and Bundles to package offerings together. The resource configuration reference explains the controls on a resource.