Composable identity governanceBuilding blocks shaped to your business.
Most governance platforms ship a shape and ask your business to fit. Owlie ships the blocks — and your business is the shape.
Versioned by design · Audit-ready by default
Julia Stark
ActiveJulia Stark
julia.stark@blue.select
People
Choose a person to explore their access, profile, and history.
Explore Julia Stark's profile, resources, and governance context.
Not a suite. A kit.
Six primitives are what your governance is made of. Everything else — screens, workflows, evidence — is assembled from them.
01
The building blocks
Built from blocks,
not fixed screens.
Owlie is assembled, not configured. The six primitives below are what your governance is made of — the pieces you reach for when the real workflow doesn’t match the demo, the approval doesn’t fit the template, or the resource doesn’t look like an app.
Resources
P-01Anything your business grants access to.
Functions
P-02Sandboxed TypeScript, typed by where it runs — an approval step, a fulfillment path, a provisioning hook, a reaction, or a plain endpoint.
Forms
P-03Custom request intake per Resource.
Hooks
P-04Pre and post steps on every connector-fulfilled provisioning operation, conditional and Function-backed.
Expressions
P-05Small, safe value transforms you reach for in attribute mappings, provisioning hooks, and reaction payload templates.
Custom Actions
P-06Admin quick-action buttons on identity and request screens, defined by you.
02
More than apps
Govern more than apps
and entitlements.
A Resource in Owlie is an open abstraction used to model anything a user can “have” or request, physical or digital. SaaS apps, sure — but also the database role, the laptop order, the badge, the shared service account, the training certificate. Each Resource carries its own entitlements, request form, approval flow, and fulfillment path.
SaaS app
CONNECTORStandard request, standard approval, connector-automated provisioning.
Birthright access
POLICYA policy grants it to every matching identity and revokes it when they no longer match — no ticket, reconciled continuously per your revocation policy.
Emergency production access
TIME-BOXEDA user requests it with justification; approved and time-boxed, the grant expires automatically after four hours.
Laptop
MANUALCustom form captures OS + specs, manual fulfillment by IT, evidence logged.
Physical badge
LIFECYCLERequested by the hiring manager, fulfilled manually by facilities, revoked on lifecycle events.
Training-gated access
CERTIFICATIONAccess that requires an active certification — composable with time-bound windows and recurring re-certification campaigns.
Primitives — what governance is made of
Emergency window, auto-revoked
Pipeline for every access change
03
The engine
Intent-based execution.
Built to reconcile.
Owlie treats every access change as intent: the access state that should exist when the work is done. It compares that intent with current reality, computes a provisioning plan from the changes needed, and applies the plan through the right path — connector, manual task, Function, or custom integration.
Because each change is versioned, Owlie can reason about retries, overlap, partial failure, and drift. Work can be safely retried, superseded when stale, or reconciled when downstream state changes, with evidence written as the system moves toward intent.
Intent before action.
3.1Owlie records the desired access state before touching the downstream system.
Plans from the gap.
3.2Owlie computes what needs to change, then applies that plan.
Versioned to converge.
3.3Retries, overlaps, and drift resolve against the latest intended state.
04
See it running
Three short compositions.
An access request, start to finish.
LC-04Request submitted → approved → auto-provisioned → notified → audited. Same flow for any Resource.
Pipeline in motion — request + execution journal
Request header + execution journal with 4–5 status rows.
Order a laptop, in Owlie.
LC-05A custom Resource, composed from blocks. Form, approval, fulfillment — each a part that snaps in.
Composition — Laptop Order Resource anatomy
Laptop Order Resource — Form, Approval (Function-backed), Fulfillment (manual ticket).
Four hours of production admin access.
LC-06A user requests it; an approver approves; the engine grants a four-hour window and revokes it automatically when the time is up.
Timed access — request + time-boxed activity
Request form + small activity row with an auto-expiry countdown.
05
Who it’s for
Built for teams that need access
to stay correct over time.
Security
Approved intent verified against actual state. Drift is a signal, not a surprise.
Compliance
Evidence captured as the work runs. Audit answers come from the system.
Owlie is built for security-sensitive access work.
Governance that fits the shape of your business. Early access is open for mid-market teams ready to shape their own governance — not adopt someone else’s.
Or watch the walkthrough →Open for mid-market teams