How Camper works

Camper keeps membership in downstream apps aligned with who people are in your org chart. It does not replace your identity provider. It sits beside it: people and structure come in via SCIM; Camper decides who should be on which group, channel, or team; connectors make the change.

The control loop

IdP (Okta, Entra, …)
   │  SCIM Users / Groups
   ▼
Camper directory  ──►  desired memberships  ──►  target apps
   │                      ▲                         │
   │                      │    observe + diff       │
   └──── org units & links ─────────────────────────┘

Stage	What happens
Ingest	Your IdP pushes people and groups into Camper over SCIM. Attributes and groups become org units.
Desire	Active people × resource links (and pins) produce the membership Camper wants. Exempt accounts are never desired.
Observe	Connectors list who is actually on each resource today.
Converge	Diff + safety rules become provisioning tasks. The worker applies them per provider.

Unlike push-groups alone, Camper can create and archive managed resources when org units change, and rename any linked resource (created or attached) when you opt into follow-naming or use Rename on the resource.

Two planes (do not mix them)

Plane	Question	Where in Camper
Directory	Who exists? Where do they sit? Who may operate Camper?	Settings → Identity Providers, Settings → Mappings, People, Catalog
Targets	Which apps should Camper write membership into?	Connections, then Resources

Sign-in is a third concern: SSO, email codes, passkeys answer how someone opens the dashboard — not who is in the org chart.

Okta and Entra are directory sources, not Connections. Connecting Google or Slack does not import people.

Org units and axes

Real companies rarely fit one nested tree.

Axes are independent slices of the org (Department, Teams, Office, …). A person can sit on several axes at once.
Units on an axis are the places resources attach (Engineering, #platform-team, London, …).
Units start as suggested when SCIM first sees a value. Operators import the ones they manage. Only imported units accept resource links.

Details: Org axes & units, Org catalog.

Resource links

A link binds one org unit to one downstream object (Google Group, Slack channel, GitHub team, …). On each link you set:

Decision	Typical choices
Scope	This unit only, or unit + children
Role	Member or owner (when the app supports it)
Movers	Remove when they leave the unit, or keep (add-only)
Leavers	Remove on suspend/deprovision vs keep longer
Outsiders	Report as drift, enforce (remove), or ignore
Ownership	Managed (create/archive) vs attached (membership). Either can follow org naming or be renamed from the resource page

Every create and edit ends in a dry run. Confirming saves the link; the worker applies membership on reconcile. Unlink drops the unit ↔ resource binding without deleting the object or emptying membership. Guide: Link resources.

From an imported unit, Link resources can find matches across apps — unlinked objects whose names resemble the unit — so several groups or channels are linked in one pass under one set of rules. Every one of them still dry-runs first.

Safety by default

Behaviour	Why
Unmatched downstream members → external drift	Camper did not place them; do not delete by surprise
Large removal batches → blocked for review	Guardrail against bad maps or bulk mistakes
Add-only links retain movers	Knowledge continuity on channels that should not thrash
Pins for exceptions	One person stays without widening the whole policy
Exempt accounts	Workspace admins and bots stay put and stay silent — never added, never removed, never drift
Trial / past-due pauses writes only	Dry run, SCIM, and audit keep working

Day-to-day queues live under Activity & drift.

Operators vs workers

Audience	How they get access	What they see
Operators	Workspace owner, or SCIM `Admin`	Full dashboard
Workers	SCIM user without Admin (default Viewer)	My Access

Same person can be both a directory identity and an operator. Details: Roles.

Finding your way around

The sidebar groups surfaces by the question each answers:

Group	Surfaces	Answers
—	Overview	Is anything wrong right now?
Directory	People, Catalog, Graph	Who exists, and how is the org structured?
Access	Resources, Connections	What do they get, and where does it go?
Operations	Activity	What happened, and what failed?

My Access and Settings sit at the bottom. A count on a nav item means something is waiting on you.