diff --git a/xos/synchronizer/model_policies/model_policy_att_workflow_driver_service.py b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_service.py
new file mode 100644
index 0000000..5fb076c
--- /dev/null
+++ b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_service.py
@@ -0,0 +1,46 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+from synchronizers.new_base.modelaccessor import AttWorkflowDriverServiceInstance, model_accessor
+from synchronizers.new_base.policy import Policy
+
+class AttWorkflowDriverServicePolicy(Policy):
+    model_name = "AttWorkflowDriverService"
+
+    def handle_update(self, service):
+        self.logger.debug("MODEL_POLICY: handle_update for AttWorkflowDriverService", oss=service)
+
+        sis = AttWorkflowDriverServiceInstance.objects.all()
+
+        # TODO(smbaker): This is redudant with AttWorkflowDriverWhiteListEntry model policy, though etaining this does provide
+        # a handy way to trigger a full reexamination of the whitelist.
+
+        whitelist = [x.serial_number for x in service.whitelist_entries.all()]
+
+        for si in sis:
+            if si.serial_number in whitelist and not si.valid == "valid":
+                self.logger.debug("MODEL_POLICY: activating AttWorkflowDriverServiceInstance because of change in the whitelist", si=si)
+                si.valid = "valid"
+                si.save(update_fields=["valid", "no_sync", "updated"], always_update_timestamp=True)
+            if si.serial_number not in whitelist and not si.valid == "invalid":
+                self.logger.debug(
+                    "MODEL_POLICY: disabling AttWorkflowDriverServiceInstance because of change in the whitelist", si=si)
+                si.valid = "invalid"
+                si.save(update_fields=["valid", "no_sync", "updated"], always_update_timestamp=True)
+
+
+    def handle_delete(self, si):
+        pass
diff --git a/xos/synchronizer/model_policies/model_policy_att_workflow_driver_serviceinstance.py b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_serviceinstance.py
new file mode 100644
index 0000000..25d824a
--- /dev/null
+++ b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_serviceinstance.py
@@ -0,0 +1,109 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+from synchronizers.new_base.modelaccessor import RCORDSubscriber, ONUDevice, model_accessor
+from synchronizers.new_base.policy import Policy
+
+class AttWorkflowDriverServiceInstancePolicy(Policy):
+    model_name = "AttWorkflowDriverServiceInstance"
+
+    def handle_create(self, si):
+        self.logger.debug("MODEL_POLICY: handle_create for AttWorkflowDriverServiceInstance %s " % si.id)
+        self.handle_update(si)
+
+    def update_and_save_subscriber(self, subscriber, si, update_timestamp=False):
+        if si.authentication_state == "STARTED":
+            subscriber.status = "awaiting-auth"
+        elif si.authentication_state == "REQUESTED":
+            subscriber.status = "awaiting-auth"
+        elif si.authentication_state == "APPROVED":
+            subscriber.status = "enabled"
+        elif si.authentication_state == "DENIED":
+            subscriber.status = "auth-failed"
+
+        # If the OSS returns a c_tag use that one
+        if si.c_tag:
+            subscriber.c_tag = si.c_tag
+
+        subscriber.save(always_update_timestamp=update_timestamp)
+
+    def create_subscriber(self, si):
+        subscriber = RCORDSubscriber()
+        subscriber.onu_device = si.serial_number
+        subscriber.status == "awaiting-auth"
+
+        return subscriber
+
+    def handle_update(self, si):
+        self.logger.debug("MODEL_POLICY: handle_update for AttWorkflowDriverServiceInstance %s, valid=%s " % (si.id, si.valid))
+
+        # Check to make sure the object has been synced. This is to cover a race condition where the model_policy
+        # runs, is interrupted by the sync step, the sync step completes, and then the model policy ends up saving
+        # a policed_timestamp that is later the updated timestamp set by the sync_step.
+        if (si.backend_code!=1):
+            raise Exception("MODEL_POLICY: AttWorkflowDriverServiceInstance %s has not been synced yet" % si.id)
+
+        if not hasattr(si, 'valid') or si.valid is "awaiting":
+            self.logger.debug("MODEL_POLICY: skipping handle_update for AttWorkflowDriverServiceInstance %s as not validated yet" % si.id)
+            return
+        if si.valid == "invalid":
+            self.logger.debug("MODEL_POLICY: disabling ONUDevice [%s] for AttWorkflowDriverServiceInstance %s" % (si.serial_number, si.id))
+            onu = ONUDevice.objects.get(serial_number=si.serial_number)
+            onu.admin_state = "DISABLED"
+            onu.save(always_update_timestamp=True)
+            return
+        if si.valid == "valid":
+
+            # reactivating the ONUDevice
+            try:
+                onu = ONUDevice.objects.get(serial_number=si.serial_number)
+            except IndexError:
+                raise Exception("MODEL_POLICY: cannot find ONUDevice [%s] for AttWorkflowDriverServiceInstance %s" % (si.serial_number, si.id))
+            if onu.admin_state == "DISABLED":
+                self.logger.debug("MODEL_POLICY: enabling ONUDevice [%s] for AttWorkflowDriverServiceInstance %s" % (si.serial_number, si.id))
+                onu.admin_state = "ENABLED"
+                onu.save(always_update_timestamp=True)
+
+            # handling the subscriber status
+
+            subscriber = None
+            try:
+                subscriber = RCORDSubscriber.objects.get(onu_device=si.serial_number)
+            except IndexError:
+                # we just want to find out if it exists or not
+                pass
+
+            # if subscriber does not exist
+            self.logger.debug("MODEL_POLICY: handling subscriber", onu_device=si.serial_number, create_on_discovery=si.owner.leaf_model.create_on_discovery)
+            if not subscriber:
+                # and create_on_discovery is false
+                if not si.owner.leaf_model.create_on_discovery:
+                    # do not create the subscriber, unless it has been approved
+                    if si.authentication_state == "APPROVED":
+                        self.logger.debug("MODEL_POLICY: creating subscriber as authentication_sate=APPROVED")
+                        subscriber = self.create_subscriber(si)
+                        self.update_and_save_subscriber(subscriber, si)
+                else:
+                    self.logger.debug("MODEL_POLICY: creating subscriber")
+                    subscriber = self.create_subscriber(si)
+                    self.update_and_save_subscriber(subscriber, si)
+            # if the subscriber is there and authentication is complete, update its state
+            elif subscriber and si.authentication_state == "APPROVED":
+                self.logger.debug("MODEL_POLICY: updating subscriber status")
+                self.update_and_save_subscriber(subscriber, si, update_timestamp=True)
+
+    def handle_delete(self, si):
+        pass
diff --git a/xos/synchronizer/model_policies/model_policy_att_workflow_driver_whitelistentry.py b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_whitelistentry.py
new file mode 100644
index 0000000..c38e7ec
--- /dev/null
+++ b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_whitelistentry.py
@@ -0,0 +1,59 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+from synchronizers.new_base.modelaccessor import AttWorkflowDriverServiceInstance, AttWorkflowDriverWhiteListEntry, model_accessor
+from synchronizers.new_base.policy import Policy
+
+class AttWorkflowDriverWhiteListEntryPolicy(Policy):
+    model_name = "AttWorkflowDriverWhiteListEntry"
+
+    def handle_create(self, whitelist):
+        self.handle_update(whitelist)
+
+    def handle_update(self, whitelist):
+        self.logger.debug("MODEL_POLICY: handle_update for AttWorkflowDriverWhiteListEntry", whitelist=whitelist)
+
+        sis = AttWorkflowDriverServiceInstance.objects.filter(serial_number = whitelist.serial_number,
+                                                   owner_id = whitelist.owner.id)
+
+        for si in sis:
+            if si.valid != "valid":
+                self.logger.debug("MODEL_POLICY: activating AttWorkflowDriverServiceInstance because of change in the whitelist", si=si)
+                si.valid = "valid"
+                si.save(update_fields=["valid", "no_sync", "updated"], always_update_timestamp=True)
+
+        whitelist.backend_need_delete_policy=True
+        whitelist.save(update_fields=["backend_need_delete_policy"])
+
+    def handle_delete(self, whitelist):
+        self.logger.debug("MODEL_POLICY: handle_delete for AttWorkflowDriverWhiteListEntry", whitelist=whitelist)
+
+        # BUG: Sometimes the delete policy is not called, because the reaper deletes
+
+        assert(whitelist.owner)
+
+        sis = AttWorkflowDriverServiceInstance.objects.filter(serial_number = whitelist.serial_number,
+                                                   owner_id = whitelist.owner.id)
+
+        for si in sis:
+            if si.valid != "invalid":
+                self.logger.debug(
+                    "MODEL_POLICY: disabling AttWorkflowDriverServiceInstance because of change in the whitelist", si=si)
+                si.valid = "invalid"
+                si.save(update_fields=["valid", "no_sync", "updated"], always_update_timestamp=True)
+
+        whitelist.backend_need_reap=True
+        whitelist.save(update_fields=["backend_need_reap"])
diff --git a/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_service.py b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_service.py
new file mode 100644
index 0000000..3af7cfe
--- /dev/null
+++ b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_service.py
@@ -0,0 +1,130 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import unittest
+from mock import patch, call, Mock, PropertyMock
+
+import os, sys
+
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+service_dir=os.path.join(test_path, "../../../..")
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir=os.path.join(xos_dir, "../../xos_services")
+
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+
+class TestModelPolicyAttWorkflowDriverService(unittest.TestCase):
+    def setUp(self):
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        config = os.path.join(test_path, "../test_config.yaml")
+        from xosconfig import Config
+        Config.clear()
+        Config.init(config, 'synchronizer-config-schema.yaml')
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("att-workflow-driver", "att-workflow-driver.xproto"),
+            get_models_fn("olt-service", "volt.xproto"),
+            get_models_fn("../profiles/rcord", "rcord.xproto")
+        ])
+
+        import synchronizers.new_base.modelaccessor
+        from model_policy_att_workflow_driver_service import AttWorkflowDriverServicePolicy, model_accessor
+
+        from mock_modelaccessor import MockObjectList
+        self.MockObjectList = MockObjectList
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+        # Some of the functions we call have side-effects. For example, creating a VSGServiceInstance may lead to creation of
+        # tags. Ideally, this wouldn't happen, but it does. So make sure we reset the world.
+        model_accessor.reset_all_object_stores()
+
+        self.policy = AttWorkflowDriverServicePolicy()
+
+        self.service = AttWorkflowDriverService(
+            id = 5367,
+            whitelist_entries = [],
+        )
+
+        # needs to be enabled
+        self.si1 = AttWorkflowDriverServiceInstance(
+            valid="awaiting",
+            serial_number="BRCM111"
+        )
+
+        # needs to be enabled
+        self.si2 = AttWorkflowDriverServiceInstance(
+            valid="invalid",
+            serial_number="BRCM222"
+        )
+
+        # remains disabled
+        self.si3 = AttWorkflowDriverServiceInstance(
+            valid="invalid",
+            serial_number="BRCM333"
+        )
+
+        # needs to be disabled
+        self.si4 = AttWorkflowDriverServiceInstance(
+            valid="valid",
+            serial_number="BRCM444"
+        )
+
+    def tearDown(self):
+        sys.path = self.sys_path_save
+        self.service = None
+
+    def test_whitelist_update(self):
+        """
+        When the whitelist is updated, check for added ONU to be enabled and for removed ONU to be disabled
+        """
+        with patch.object(AttWorkflowDriverServiceInstance.objects, "get_items") as oss_si, \
+            patch.object(self.si1, "save") as si1_save, \
+            patch.object(self.si2, "save") as si2_save, \
+            patch.object(self.si3, "save") as si3_save, \
+            patch.object(self.si4, "save") as si4_save:
+            oss_si.return_value = [self.si1, self.si2, self.si3, self.si4]
+
+            wle1 = AttWorkflowDriverWhiteListEntry(owner_id=self.service.id, serial_number="BRCM111")
+            wle2 = AttWorkflowDriverWhiteListEntry(owner_id=self.service.id, serial_number="BRCM222")
+            self.service.whitelist_entries = self.MockObjectList([wle1, wle2])
+
+            self.policy.handle_update(self.service)
+
+            self.si1.save.assert_called_with(always_update_timestamp=True, update_fields=['valid', 'no_sync', 'updated'])
+            self.assertEqual(self.si1.valid, "valid")
+            self.si2.save.assert_called_with(always_update_timestamp=True, update_fields=['valid', 'no_sync', 'updated'])
+            self.assertEqual(self.si2.valid, "valid")
+            self.si3.save.assert_not_called()
+            self.assertEqual(self.si3.valid, "invalid")
+            self.si4.save.assert_called_with(always_update_timestamp=True, update_fields=['valid', 'no_sync', 'updated'])
+            self.assertEqual(self.si4.valid, "invalid")
+
+if __name__ == '__main__':
+    unittest.main()
+
diff --git a/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_serviceinstance.py b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_serviceinstance.py
new file mode 100644
index 0000000..a34fedc
--- /dev/null
+++ b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_serviceinstance.py
@@ -0,0 +1,284 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import unittest
+from mock import patch, call, Mock, PropertyMock
+
+import os, sys
+
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+service_dir=os.path.join(test_path, "../../../..")
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir=os.path.join(xos_dir, "../../xos_services")
+
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+
+class TestModelPolicyAttWorkflowDriverServiceInstance(unittest.TestCase):
+    def setUp(self):
+
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        config = os.path.join(test_path, "../test_config.yaml")
+        from xosconfig import Config
+        Config.clear()
+        Config.init(config, 'synchronizer-config-schema.yaml')
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("att-workflow-driver", "att-workflow-driver.xproto"),
+            get_models_fn("olt-service", "volt.xproto"),
+            get_models_fn("../profiles/rcord", "rcord.xproto")
+        ])
+
+        import synchronizers.new_base.modelaccessor
+        from model_policy_att_workflow_driver_serviceinstance import AttWorkflowDriverServiceInstancePolicy, model_accessor
+
+        from mock_modelaccessor import MockObjectList
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+        # Some of the functions we call have side-effects. For example, creating a VSGServiceInstance may lead to creation of
+        # tags. Ideally, this wouldn't happen, but it does. So make sure we reset the world.
+        model_accessor.reset_all_object_stores()
+
+        self.policy = AttWorkflowDriverServiceInstancePolicy()
+        self.si = AttWorkflowDriverServiceInstance()
+        self.si.owner = AttWorkflowDriverService()
+
+    def tearDown(self):
+        sys.path = self.sys_path_save
+        self.si = None
+
+    def test_not_synced(self):
+        self.si.valid = "awaiting"
+        self.si.backend_code = 0
+
+        with patch.object(RCORDSubscriber, "save") as subscriber_save, \
+            patch.object(ONUDevice, "save") as onu_save:
+
+            with self.assertRaises(Exception) as e:
+               self.policy.handle_update(self.si)
+
+            self.assertIn("has not been synced yet", e.exception.message)
+
+    def test_skip_update(self):
+        self.si.valid = "awaiting"
+        self.si.backend_code = 1
+
+        with patch.object(RCORDSubscriber, "save") as subscriber_save, \
+            patch.object(ONUDevice, "save") as onu_save:
+
+            self.policy.handle_update(self.si)
+            subscriber_save.assert_not_called()
+            onu_save.assert_not_called()
+
+    def test_disable_onu(self):
+        self.si.valid = "invalid"
+        self.si.serial_number = "BRCM1234"
+        self.si.backend_code = 1
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber, "save") as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+            subscriber_save.assert_not_called()
+            self.assertEqual(onu.admin_state, "DISABLED")
+            onu_save.assert_called()
+
+    def test_enable_onu(self):
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.c_tag = None
+        self.si.backend_code = 1
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="DISABLED"
+        )
+
+        subscriber = RCORDSubscriber(
+            onu_device=self.si.serial_number,
+            status='pre-provisioned'
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber.objects, "get_items") as subscriber_objects, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+            subscriber_objects.return_value = [subscriber]
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(onu.admin_state, "ENABLED")
+            onu_save.assert_called()
+
+    def test_do_not_create_subscriber(self):
+        self.si.valid = "valid"
+        self.si.backend_code = 1
+        self.si.serial_number = "BRCM1234"
+        self.si.authentication_state = "DENIEND"
+        self.si.owner.leaf_model.create_on_discovery = False
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="DISABLED"
+        )
+        
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+
+            self.assertEqual(onu.admin_state, "ENABLED")
+            onu_save.assert_called()
+            self.assertEqual(subscriber_save.call_count, 0)
+
+    def test_create_subscriber(self):
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.backend_code = 1
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="ENABLED"
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(subscriber_save.call_count, 1)
+
+            subscriber = subscriber_save.call_args[0][0]
+            self.assertEqual(subscriber.onu_device, self.si.serial_number)
+
+            onu_save.assert_not_called()
+    
+    def test_create_subscriber_no_create_on_discovery(self):
+        """
+        test_create_subscriber_no_create_on_discovery
+        When si.owner.create_on_discovery = False we still need to create the subscriber after authentication
+        """
+
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.backend_code = 1
+        self.si.owner.leaf_model.create_on_discovery = False
+        self.si.authentication_state = "APPROVED"
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="ENABLED"
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(subscriber_save.call_count, 1)
+
+            subscriber = subscriber_save.call_args[0][0]
+            self.assertEqual(subscriber.onu_device, self.si.serial_number)
+
+            onu_save.assert_not_called()
+
+    def test_create_subscriber_with_ctag(self):
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.c_tag = 111
+        self.si.backend_code = 1
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="ENABLED"
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(subscriber_save.call_count, 1)
+
+            subscriber = subscriber_save.call_args[0][0]
+            self.assertEqual(subscriber.onu_device, self.si.serial_number)
+            self.assertEqual(subscriber.c_tag, self.si.c_tag)
+
+            onu_save.assert_not_called()
+
+    def _test_add_c_tag_to_pre_provisioned_subscriber(self):
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.c_tag = 111
+        self.si.backend_code = 1
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="ENABLED"
+        )
+
+        subscriber = RCORDSubscriber(
+            onu_device=self.si.serial_number,
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber.objects, "get_items") as subscriber_objects, \
+                patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+            subscriber_objects.return_value = [subscriber]
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(subscriber_save.call_count, 1)
+
+            subscriber = subscriber_save.call_args[0][0]
+            self.assertEqual(subscriber.onu_device, self.si.serial_number)
+            self.assertEqual(subscriber.c_tag, self.si.c_tag)
+
+            onu_save.assert_not_called()
+
+if __name__ == '__main__':
+    unittest.main()
+
diff --git a/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_whitelistentry.py b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_whitelistentry.py
new file mode 100644
index 0000000..73c077a
--- /dev/null
+++ b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_whitelistentry.py
@@ -0,0 +1,106 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import unittest
+from mock import patch, call, Mock, PropertyMock
+
+import os, sys
+
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+service_dir=os.path.join(test_path, "../../../..")
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir=os.path.join(xos_dir, "../../xos_services")
+
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+
+class TestModelPolicyAttWorkflowDriverWhiteListEntry(unittest.TestCase):
+    def setUp(self):
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        config = os.path.join(test_path, "../test_config.yaml")
+        from xosconfig import Config
+        Config.clear()
+        Config.init(config, 'synchronizer-config-schema.yaml')
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("att-workflow-driver", "att-workflow-driver.xproto"),
+            get_models_fn("olt-service", "volt.xproto"),
+            get_models_fn("../profiles/rcord", "rcord.xproto")
+        ])
+
+        import synchronizers.new_base.modelaccessor
+        from model_policy_att_workflow_driver_whitelistentry import AttWorkflowDriverWhiteListEntryPolicy, model_accessor
+
+        from mock_modelaccessor import MockObjectList
+        self.MockObjectList = MockObjectList
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+        # Some of the functions we call have side-effects. For example, creating a VSGServiceInstance may lead to creation of
+        # tags. Ideally, this wouldn't happen, but it does. So make sure we reset the world.
+        model_accessor.reset_all_object_stores()
+
+        self.policy = AttWorkflowDriverWhiteListEntryPolicy()
+
+        self.service = AttWorkflowDriverService()
+
+
+    def tearDown(self):
+        sys.path = self.sys_path_save
+        self.service = None
+
+    def test_whitelist_update(self):
+        """
+        When a whitelist entry is added, see that the AttWorkflowDriverIServicenstance was set to valid
+        """
+        with patch.object(AttWorkflowDriverServiceInstance.objects, "get_items") as oss_si_items:
+            si = AttWorkflowDriverServiceInstance(serial_number="BRCM333", owner_id=self.service.id, valid="invalid")
+            oss_si_items.return_value = [si]
+
+            wle = AttWorkflowDriverWhiteListEntry(serial_number="BRCM333", owner_id=self.service.id, owner=self.service)
+
+            self.policy.handle_update(wle)
+
+            self.assertEqual(si.valid, "valid")
+
+    def test_whitelist_delete(self):
+        """
+        When a whitelist entry is deleted, see that the AttWorkflowDriverIServicenstance was set to invalid
+        """
+        with patch.object(AttWorkflowDriverServiceInstance.objects, "get_items") as oss_si_items:
+            si = AttWorkflowDriverServiceInstance(serial_number="BRCM333", owner_id=self.service.id, valid="valid")
+            oss_si_items.return_value = [si]
+
+            wle = AttWorkflowDriverWhiteListEntry(serial_number="BRCM333", owner_id=self.service.id, owner=self.service)
+
+            self.policy.handle_delete(wle)
+
+            self.assertEqual(si.valid, "invalid")
+
+if __name__ == '__main__':
+    unittest.main()
+