DOCSEARCHbyAlgolia
Submit Docs

Owlie Identity Governance and Administration

website·Indexed 30 days ago

https://owlie.com/docs

An identity governance and administration (IGA) platform for managing identities, including employees, contractors, and service accounts, as governed records. Owlie provides tools for access provisioning, governance, and audit readiness with a GraphQL API and an on-prem gateway agent for private-network connectors.

Tokens
184.7K
Snippets
883
Records
1.8K
Agent score
49%

What's inside Owlie

  1. Overview of Owlie Identity Governance Platform

    Owlie is a composable identity governance platform designed for IT, Security, and Compliance teams at mid-market companies (100–3,000 employees). It provides a governance runtime to model business access workflows using intent-based, versioned provisioning. The platform focuses on capturing evidence during execution to simplify audits and verifying external state via synchronization.

  2. ReviewStep GraphQL object definition

    The ReviewStep object represents a specific step within a review process. It contains metadata about the reviewer, the decision made, the timing of the step, and its order in the sequence.
    type ReviewStep {
  decided_at: DateTimeISO
  decided_by: ID
  decision: ReviewOutcome
  due_at: DateTimeISO
  id: ID!
  reason: String
  resolved_reviewer_type: String
  reviewer: ReviewStepReviewer
  reviewer_type: String!
  status: ReviewStepStatus!
  step_order: Int!
}

  3. BulkJobFailure GraphQL object definition

    The BulkJobFailure object is used to represent a failure within a bulk job. It contains details about the specific error, the identity associated with the failure, and the current status of the job.
    type BulkJobFailure {
  error: String!
  identityId: ID!
  status: BulkJobStatus!
}

  4. Understand the difference between Access Governance and Provisioning

    Access programs consist of two distinct but connected responsibilities that fail in different ways:

    1. Governance (The Decision Layer): Focuses on who should have access, on what basis, who approved it, and the review cadence. Its primary output is a defensible decision and a durable record (evidence) of that decision. Governance fails 'quietly' when decisions cannot be reconstructed or accounted for.
    2. Provisioning (The Execution Layer): Focuses on turning a decision into concrete state on real systems (e.g., creating accounts, adding grants, revoking access). It is judged on reliability and the absence of drift or half-finished operations. Provisioning fails 'loudly' through broken onboarding or failed revocations.

  5. Understand the ReviewCampaignExport object

    The ReviewCampaignExport object represents an asynchronous NDJSON job used to export campaign evidence. Only one export may be in flight per campaign at a time. When a job finishes, the requester is notified via the review.campaign_export_ready event.

    Export Statuses:

    • PENDING: The job is currently streaming the file.
    • COMPLETED: The export is finished and a downloadable file ID is available.
    • FAILED: The export failed; a reason is provided and no file is generated.

  6. Understand the difference between Resources, Assignments, and Grants

    In Owlie, a resource represents the offering itself (what is available and how it is fulfilled). An assigned resource is the specific instance of that offering linked to a unique identity; multiple people receiving the same resource will each have their own separate assignment with its own state. For connected systems, an assignment may link to an account, while specific entitlements within that system (such as folder permissions or group memberships) are called Grants.

  8. ReviewPolicyDryRun GraphQL Object Reference

    The ReviewPolicyDryRun object provides the results of a review policy dry run. It is returned by the dryRunReviewPolicy query and contains details about the effective policy, access rights, and the stages of the dry run process.
    type ReviewPolicyDryRun {
  access: ReviewPolicyDryRunAccess!
  effectivePolicy: JSON!
  grantId: ID!
  policyLineage: JSON!
  stages: [ReviewPolicyDryRunStage!]!
  timing: JSON
}

  9. Understand the PublishCustomConnectorVersionResult GraphQL type

    The PublishCustomConnectorVersionResult object is returned by the publishCustomConnectorVersion mutation. It provides details about both the newly created draft and the version that was successfully published.
    type PublishCustomConnectorVersionResult {
  new_draft: CustomConnectorVersion!
  published: CustomConnectorVersion!
}

  10. RequestEvent GraphQL object definition

    The RequestEvent object represents an event associated with a request. It contains details about the actor who triggered the event, the event type, timing, and associated data/metadata.
    type RequestEvent {
  actor_data: IdentityDisplay
  actor_reference_id: ID
  actor_type: RequestEventActorType!
  created_at: DateTimeISO!
  event_data: JSONObject!
  event_type: RequestEventType!
  id: ID!
  metadata: JSONObject!
  updated_at: DateTimeISO!
}

  11. Map IGA requirements to Owlie features

    Owlie provides composable blocks to satisfy IGA checklist requirements:

    • Access Requests: Supports routing to correct approvers, staged approvals, and quorum decisions.
    • Provisioning: Drives approved/revoked decisions to connected systems and journals every attempt.
    • Policies: Declares required and forbidden access (including separation-of-duties) and continuously converges reality toward that declaration.
    • Access Reviews: Captures immutable snapshots of subjects, grants, and policies; prevents self-certification; and exports verifiable evidence packets.

  12. Use the DelegationInfo GraphQL object

    The DelegationInfo object is used within the GraphQL schema to provide details about a delegation. It contains information regarding the status of the delegation, the identity of the delegator, and the time period during which the delegation is valid.
    type DelegationInfo {
  active: Boolean!
  delegator: Identity!
  endAt: DateTimeISO
  startAt: DateTimeISO
}