diff --git a/xos/synchronizer/att-workflow-driver-synchronizer.py b/xos/synchronizer/att-workflow-driver-synchronizer.py
new file mode 100755
index 0000000..f9ea235
--- /dev/null
+++ b/xos/synchronizer/att-workflow-driver-synchronizer.py
@@ -0,0 +1,37 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+#!/usr/bin/env python
+
+# This imports and runs ../../xos-observer.py
+
+import importlib
+import os
+import sys
+from xosconfig import Config
+
+base_config_file = os.path.abspath(os.path.dirname(os.path.realpath(__file__)) + '/config.yaml')
+mounted_config_file = os.path.abspath(os.path.dirname(os.path.realpath(__file__)) + '/mounted_config.yaml')
+
+if os.path.isfile(mounted_config_file):
+    Config.init(base_config_file, 'synchronizer-config-schema.yaml', mounted_config_file)
+else:
+    Config.init(base_config_file, 'synchronizer-config-schema.yaml')
+
+observer_path = os.path.join(os.path.dirname(os.path.realpath(__file__)),"../../synchronizers/new_base")
+sys.path.append(observer_path)
+mod = importlib.import_module("xos-synchronizer")
+mod.main()
diff --git a/xos/synchronizer/config.yaml b/xos/synchronizer/config.yaml
new file mode 100644
index 0000000..90c0dbf
--- /dev/null
+++ b/xos/synchronizer/config.yaml
@@ -0,0 +1,42 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+name: att-workflow-driver
+required_models:
+  - AttWorkflowDriverService
+  - AttWorkflowDriverServiceInstance
+  - RCORDSubscriber
+  - ONUDevice
+model_policies_dir: "/opt/xos/synchronizers/att-workflow-driver/model_policies"
+models_dir: "/opt/xos/synchronizers/att-workflow-driver/models"
+steps_dir: "/opt/xos/synchronizers/att-workflow-driver/steps"
+event_steps_dir: "/opt/xos/synchronizers/att-workflow-driver/event_steps"
+logging:
+  version: 1
+  handlers:
+    console:
+      class: logging.StreamHandler
+    file:
+      class: logging.handlers.RotatingFileHandler
+      filename: /var/log/xos.log
+      maxBytes: 10485760
+      backupCount: 5
+  loggers:
+    'multistructlog':
+      handlers:
+          - console
+          - file
+      level: DEBUG
diff --git a/xos/synchronizer/event_steps/auth_event.py b/xos/synchronizer/event_steps/auth_event.py
new file mode 100644
index 0000000..5713f9f
--- /dev/null
+++ b/xos/synchronizer/event_steps/auth_event.py
@@ -0,0 +1,66 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import json
+import time
+import os
+import sys
+from synchronizers.new_base.eventstep import EventStep
+from synchronizers.new_base.modelaccessor import VOLTService, AttWorkflowDriverServiceInstance, model_accessor
+
+class SubscriberAuthEventStep(EventStep):
+    topics = ["authentication.events"]
+    technology = "kafka"
+
+    def __init__(self, *args, **kwargs):
+        super(SubscriberAuthEventStep, self).__init__(*args, **kwargs)
+
+    def get_onu_sn(self, event):
+        olt_service = VOLTService.objects.first()
+        onu_sn = olt_service.get_onu_sn_from_openflow(event["deviceId"], event["portNumber"])
+        if not onu_sn or onu_sn is None:
+            self.log.exception("authentication.events: Cannot find onu serial number for this event", kafka_event=event)
+            raise Exception("authentication.events: Cannot find onu serial number for this event")
+
+        return onu_sn
+
+    def get_hippie_oss_si_by_sn(self, serial_number):
+        try:
+            return AttWorkflowDriverServiceInstance.objects.get(serial_number=serial_number)
+        except IndexError:
+            self.log.exception("authentication.events: Cannot find hippie-oss service instance for this event", kafka_event=value)
+            raise Exception("authentication.events: Cannot find hippie-oss service instance for this event")
+
+
+    def activate_subscriber(self, subscriber):
+        subscriber.status = 'enabled'
+        subscriber.save()
+
+    def disable_subscriber(self, subscriber):
+        subscriber.status = 'auth-failed'
+        subscriber.save()
+
+    def process_event(self, event):
+        value = json.loads(event.value)
+
+        onu_sn = self.get_onu_sn(value)
+        si = self.get_hippie_oss_si_by_sn(onu_sn)
+        if not si:
+            self.log.exception("authentication.events: Cannot find hippie-oss service instance for this event", kafka_event=value)
+            raise Exception("authentication.events: Cannot find hippie-oss service instance for this event")
+
+        si.authentication_state = value["authenticationState"];
+        si.no_sync = True
+        si.save(update_fields=["authentication_state", "no_sync", "updated"], always_update_timestamp=True)
diff --git a/xos/synchronizer/event_steps/dhcp_event.py b/xos/synchronizer/event_steps/dhcp_event.py
new file mode 100644
index 0000000..2483e46
--- /dev/null
+++ b/xos/synchronizer/event_steps/dhcp_event.py
@@ -0,0 +1,50 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import json
+import time
+import os
+import sys
+from synchronizers.new_base.eventstep import EventStep
+from synchronizers.new_base.modelaccessor import VOLTService, RCORDSubscriber, model_accessor
+
+class SubscriberDhcpEventStep(EventStep):
+    topics = ["dhcp.events"]
+    technology = "kafka"
+
+    def __init__(self, *args, **kwargs):
+        super(SubscriberDhcpEventStep, self).__init__(*args, **kwargs)
+
+    def get_onu_sn(self, event):
+        olt_service = VOLTService.objects.first()
+        onu_sn = olt_service.get_onu_sn_from_openflow(event["deviceId"], event["portNumber"])
+        if not onu_sn or onu_sn is None:
+            self.log.exception("dhcp.events: Cannot find onu serial number for this event", kafka_event=event)
+            raise Exception("dhcp.events: Cannot find onu serial number for this event")
+
+        return onu_sn
+
+    def process_event(self, event):
+        value = json.loads(event.value)
+
+        onu_sn = self.get_onu_sn(value)
+
+        subscriber = RCORDSubscriber.objects.get(onu_device=onu_sn)
+
+        self.log.debug("dhcp.events: Got event for subscriber", subscriber=subscriber, event_value=value, onu_sn=onu_sn)
+
+        subscriber.ip_address = value["ipAddress"]
+        subscriber.mac_address = value["macAddress"]
+        subscriber.save()
diff --git a/xos/synchronizer/event_steps/test_auth_event.py b/xos/synchronizer/event_steps/test_auth_event.py
new file mode 100644
index 0000000..08887dd
--- /dev/null
+++ b/xos/synchronizer/event_steps/test_auth_event.py
@@ -0,0 +1,111 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import unittest
+from mock import patch, call, Mock, PropertyMock
+import json
+
+import os, sys
+
+# Hack to load synchronizer framework
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+service_dir=os.path.join(test_path, "../../../..")
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir=os.path.join(xos_dir, "../../xos_services")
+# END Hack to load synchronizer framework
+
+# generate model from xproto
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    else:
+        name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+        if os.path.exists(os.path.join(services_dir, name)):
+            return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+# END generate model from xproto
+
+class TestSubscriberAuthEvent(unittest.TestCase):
+
+    def setUp(self):
+
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        # Setting up the config module
+        from xosconfig import Config
+        config = os.path.join(test_path, "../test_config.yaml")
+        Config.clear()
+        Config.init(config, "synchronizer-config-schema.yaml")
+        from multistructlog import create_logger
+        log = create_logger(Config().get('logging'))
+        # END Setting up the config module
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        # build_mock_modelaccessor(xos_dir, services_dir, [get_models_fn("olt-service", "volt.xproto")])
+
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("att-workflow-driver", "att-workflow-driver.xproto"),
+            get_models_fn("olt-service", "volt.xproto"),
+            get_models_fn("../profiles/rcord", "rcord.xproto")
+        ])
+        import synchronizers.new_base.modelaccessor
+        from auth_event import SubscriberAuthEventStep, model_accessor
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+        self.log = log
+
+        self.event_step = SubscriberAuthEventStep(self.log)
+
+        self.event = Mock()
+
+        self.volt = Mock()
+        self.volt.name = "vOLT"
+        self.volt.leaf_model = Mock()
+
+        self.hippie_si = AttWorkflowDriverServiceInstance()
+        self.hippie_si.serial_number = "BRCM1234"
+        self.hippie_si.save = Mock()
+
+
+    def tearDown(self):
+        sys.path = self.sys_path_save
+
+    def test_authenticate_subscriber(self):
+
+        self.event.value = json.dumps({
+            'authenticationState': "APPROVED",
+            'deviceId': "of:0000000ce2314000",
+            'portNumber': "101",
+        })
+
+        with patch.object(VOLTService.objects, "get_items") as volt_service_mock, \
+            patch.object(AttWorkflowDriverServiceInstance.objects, "get_items") as hippie_si_mock, \
+            patch.object(self.volt, "get_onu_sn_from_openflow") as get_onu_sn:
+
+            volt_service_mock.return_value = [self.volt]
+            get_onu_sn.return_value = "BRCM1234"
+            hippie_si_mock.return_value = [self.hippie_si]
+
+            self.event_step.process_event(self.event)
+
+            self.hippie_si.save.assert_called_with(always_update_timestamp=True, update_fields=['authentication_state', 'no_sync', 'updated'])
+            self.assertEqual(self.hippie_si.authentication_state, 'APPROVED')
diff --git a/xos/synchronizer/event_steps/test_dhcp_event.py b/xos/synchronizer/event_steps/test_dhcp_event.py
new file mode 100644
index 0000000..70258a9
--- /dev/null
+++ b/xos/synchronizer/event_steps/test_dhcp_event.py
@@ -0,0 +1,116 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import unittest
+from mock import patch, call, Mock, PropertyMock
+import json
+
+import os, sys
+
+# Hack to load synchronizer framework
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+service_dir=os.path.join(test_path, "../../../..")
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir=os.path.join(xos_dir, "../../xos_services")
+# END Hack to load synchronizer framework
+
+# generate model from xproto
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    else:
+        name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+        if os.path.exists(os.path.join(services_dir, name)):
+            return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+# END generate model from xproto
+
+class TestSubscriberAuthEvent(unittest.TestCase):
+
+    def setUp(self):
+
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        # Setting up the config module
+        from xosconfig import Config
+        config = os.path.join(test_path, "../test_config.yaml")
+        Config.clear()
+        Config.init(config, "synchronizer-config-schema.yaml")
+        from multistructlog import create_logger
+        log = create_logger(Config().get('logging'))
+        # END Setting up the config module
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        # build_mock_modelaccessor(xos_dir, services_dir, [get_models_fn("olt-service", "volt.xproto")])
+
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("att-workflow-driver", "att-workflow-driver.xproto"),
+            get_models_fn("olt-service", "volt.xproto"),
+            get_models_fn("../profiles/rcord", "rcord.xproto")
+        ])
+        import synchronizers.new_base.modelaccessor
+        from dhcp_event import SubscriberDhcpEventStep, model_accessor
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+        self.log = log
+
+        self.event_step = SubscriberDhcpEventStep(self.log)
+
+        self.event = Mock()
+
+        self.volt = Mock()
+        self.volt.name = "vOLT"
+        self.volt.leaf_model = Mock()
+
+        self.subscriber = RCORDSubscriber()
+        self.subscriber.onu_device = "BRCM1234"
+        self.subscriber.save = Mock()
+
+        self.mac_address = "aa:bb:cc:dd:ee"
+        self.ip_address = "192.168.3.5"
+
+
+    def tearDown(self):
+        sys.path = self.sys_path_save
+
+    def test_dhcp_subscriber(self):
+
+        self.event.value = json.dumps({
+            "deviceId" : "of:0000000000000001",
+            "portNumber" : "1",
+            "macAddress" : self.mac_address,
+            "ipAddress" : self.ip_address
+        })
+
+        with patch.object(VOLTService.objects, "get_items") as volt_service_mock, \
+            patch.object(RCORDSubscriber.objects, "get_items") as subscriber_mock, \
+            patch.object(self.volt, "get_onu_sn_from_openflow") as get_onu_sn:
+
+            volt_service_mock.return_value = [self.volt]
+            get_onu_sn.return_value = "BRCM1234"
+            subscriber_mock.return_value = [self.subscriber]
+
+            self.event_step.process_event(self.event)
+
+            self.subscriber.save.assert_called()
+            self.assertEqual(self.subscriber.mac_address, self.mac_address)
+            self.assertEqual(self.subscriber.ip_address, self.ip_address)
diff --git a/xos/synchronizer/model_policies/model_policy_att_workflow_driver_service.py b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_service.py
new file mode 100644
index 0000000..5fb076c
--- /dev/null
+++ b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_service.py
@@ -0,0 +1,46 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+from synchronizers.new_base.modelaccessor import AttWorkflowDriverServiceInstance, model_accessor
+from synchronizers.new_base.policy import Policy
+
+class AttWorkflowDriverServicePolicy(Policy):
+    model_name = "AttWorkflowDriverService"
+
+    def handle_update(self, service):
+        self.logger.debug("MODEL_POLICY: handle_update for AttWorkflowDriverService", oss=service)
+
+        sis = AttWorkflowDriverServiceInstance.objects.all()
+
+        # TODO(smbaker): This is redudant with AttWorkflowDriverWhiteListEntry model policy, though etaining this does provide
+        # a handy way to trigger a full reexamination of the whitelist.
+
+        whitelist = [x.serial_number for x in service.whitelist_entries.all()]
+
+        for si in sis:
+            if si.serial_number in whitelist and not si.valid == "valid":
+                self.logger.debug("MODEL_POLICY: activating AttWorkflowDriverServiceInstance because of change in the whitelist", si=si)
+                si.valid = "valid"
+                si.save(update_fields=["valid", "no_sync", "updated"], always_update_timestamp=True)
+            if si.serial_number not in whitelist and not si.valid == "invalid":
+                self.logger.debug(
+                    "MODEL_POLICY: disabling AttWorkflowDriverServiceInstance because of change in the whitelist", si=si)
+                si.valid = "invalid"
+                si.save(update_fields=["valid", "no_sync", "updated"], always_update_timestamp=True)
+
+
+    def handle_delete(self, si):
+        pass
diff --git a/xos/synchronizer/model_policies/model_policy_att_workflow_driver_serviceinstance.py b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_serviceinstance.py
new file mode 100644
index 0000000..25d824a
--- /dev/null
+++ b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_serviceinstance.py
@@ -0,0 +1,109 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+from synchronizers.new_base.modelaccessor import RCORDSubscriber, ONUDevice, model_accessor
+from synchronizers.new_base.policy import Policy
+
+class AttWorkflowDriverServiceInstancePolicy(Policy):
+    model_name = "AttWorkflowDriverServiceInstance"
+
+    def handle_create(self, si):
+        self.logger.debug("MODEL_POLICY: handle_create for AttWorkflowDriverServiceInstance %s " % si.id)
+        self.handle_update(si)
+
+    def update_and_save_subscriber(self, subscriber, si, update_timestamp=False):
+        if si.authentication_state == "STARTED":
+            subscriber.status = "awaiting-auth"
+        elif si.authentication_state == "REQUESTED":
+            subscriber.status = "awaiting-auth"
+        elif si.authentication_state == "APPROVED":
+            subscriber.status = "enabled"
+        elif si.authentication_state == "DENIED":
+            subscriber.status = "auth-failed"
+
+        # If the OSS returns a c_tag use that one
+        if si.c_tag:
+            subscriber.c_tag = si.c_tag
+
+        subscriber.save(always_update_timestamp=update_timestamp)
+
+    def create_subscriber(self, si):
+        subscriber = RCORDSubscriber()
+        subscriber.onu_device = si.serial_number
+        subscriber.status == "awaiting-auth"
+
+        return subscriber
+
+    def handle_update(self, si):
+        self.logger.debug("MODEL_POLICY: handle_update for AttWorkflowDriverServiceInstance %s, valid=%s " % (si.id, si.valid))
+
+        # Check to make sure the object has been synced. This is to cover a race condition where the model_policy
+        # runs, is interrupted by the sync step, the sync step completes, and then the model policy ends up saving
+        # a policed_timestamp that is later the updated timestamp set by the sync_step.
+        if (si.backend_code!=1):
+            raise Exception("MODEL_POLICY: AttWorkflowDriverServiceInstance %s has not been synced yet" % si.id)
+
+        if not hasattr(si, 'valid') or si.valid is "awaiting":
+            self.logger.debug("MODEL_POLICY: skipping handle_update for AttWorkflowDriverServiceInstance %s as not validated yet" % si.id)
+            return
+        if si.valid == "invalid":
+            self.logger.debug("MODEL_POLICY: disabling ONUDevice [%s] for AttWorkflowDriverServiceInstance %s" % (si.serial_number, si.id))
+            onu = ONUDevice.objects.get(serial_number=si.serial_number)
+            onu.admin_state = "DISABLED"
+            onu.save(always_update_timestamp=True)
+            return
+        if si.valid == "valid":
+
+            # reactivating the ONUDevice
+            try:
+                onu = ONUDevice.objects.get(serial_number=si.serial_number)
+            except IndexError:
+                raise Exception("MODEL_POLICY: cannot find ONUDevice [%s] for AttWorkflowDriverServiceInstance %s" % (si.serial_number, si.id))
+            if onu.admin_state == "DISABLED":
+                self.logger.debug("MODEL_POLICY: enabling ONUDevice [%s] for AttWorkflowDriverServiceInstance %s" % (si.serial_number, si.id))
+                onu.admin_state = "ENABLED"
+                onu.save(always_update_timestamp=True)
+
+            # handling the subscriber status
+
+            subscriber = None
+            try:
+                subscriber = RCORDSubscriber.objects.get(onu_device=si.serial_number)
+            except IndexError:
+                # we just want to find out if it exists or not
+                pass
+
+            # if subscriber does not exist
+            self.logger.debug("MODEL_POLICY: handling subscriber", onu_device=si.serial_number, create_on_discovery=si.owner.leaf_model.create_on_discovery)
+            if not subscriber:
+                # and create_on_discovery is false
+                if not si.owner.leaf_model.create_on_discovery:
+                    # do not create the subscriber, unless it has been approved
+                    if si.authentication_state == "APPROVED":
+                        self.logger.debug("MODEL_POLICY: creating subscriber as authentication_sate=APPROVED")
+                        subscriber = self.create_subscriber(si)
+                        self.update_and_save_subscriber(subscriber, si)
+                else:
+                    self.logger.debug("MODEL_POLICY: creating subscriber")
+                    subscriber = self.create_subscriber(si)
+                    self.update_and_save_subscriber(subscriber, si)
+            # if the subscriber is there and authentication is complete, update its state
+            elif subscriber and si.authentication_state == "APPROVED":
+                self.logger.debug("MODEL_POLICY: updating subscriber status")
+                self.update_and_save_subscriber(subscriber, si, update_timestamp=True)
+
+    def handle_delete(self, si):
+        pass
diff --git a/xos/synchronizer/model_policies/model_policy_att_workflow_driver_whitelistentry.py b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_whitelistentry.py
new file mode 100644
index 0000000..c38e7ec
--- /dev/null
+++ b/xos/synchronizer/model_policies/model_policy_att_workflow_driver_whitelistentry.py
@@ -0,0 +1,59 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+from synchronizers.new_base.modelaccessor import AttWorkflowDriverServiceInstance, AttWorkflowDriverWhiteListEntry, model_accessor
+from synchronizers.new_base.policy import Policy
+
+class AttWorkflowDriverWhiteListEntryPolicy(Policy):
+    model_name = "AttWorkflowDriverWhiteListEntry"
+
+    def handle_create(self, whitelist):
+        self.handle_update(whitelist)
+
+    def handle_update(self, whitelist):
+        self.logger.debug("MODEL_POLICY: handle_update for AttWorkflowDriverWhiteListEntry", whitelist=whitelist)
+
+        sis = AttWorkflowDriverServiceInstance.objects.filter(serial_number = whitelist.serial_number,
+                                                   owner_id = whitelist.owner.id)
+
+        for si in sis:
+            if si.valid != "valid":
+                self.logger.debug("MODEL_POLICY: activating AttWorkflowDriverServiceInstance because of change in the whitelist", si=si)
+                si.valid = "valid"
+                si.save(update_fields=["valid", "no_sync", "updated"], always_update_timestamp=True)
+
+        whitelist.backend_need_delete_policy=True
+        whitelist.save(update_fields=["backend_need_delete_policy"])
+
+    def handle_delete(self, whitelist):
+        self.logger.debug("MODEL_POLICY: handle_delete for AttWorkflowDriverWhiteListEntry", whitelist=whitelist)
+
+        # BUG: Sometimes the delete policy is not called, because the reaper deletes
+
+        assert(whitelist.owner)
+
+        sis = AttWorkflowDriverServiceInstance.objects.filter(serial_number = whitelist.serial_number,
+                                                   owner_id = whitelist.owner.id)
+
+        for si in sis:
+            if si.valid != "invalid":
+                self.logger.debug(
+                    "MODEL_POLICY: disabling AttWorkflowDriverServiceInstance because of change in the whitelist", si=si)
+                si.valid = "invalid"
+                si.save(update_fields=["valid", "no_sync", "updated"], always_update_timestamp=True)
+
+        whitelist.backend_need_reap=True
+        whitelist.save(update_fields=["backend_need_reap"])
diff --git a/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_service.py b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_service.py
new file mode 100644
index 0000000..3af7cfe
--- /dev/null
+++ b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_service.py
@@ -0,0 +1,130 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import unittest
+from mock import patch, call, Mock, PropertyMock
+
+import os, sys
+
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+service_dir=os.path.join(test_path, "../../../..")
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir=os.path.join(xos_dir, "../../xos_services")
+
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+
+class TestModelPolicyAttWorkflowDriverService(unittest.TestCase):
+    def setUp(self):
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        config = os.path.join(test_path, "../test_config.yaml")
+        from xosconfig import Config
+        Config.clear()
+        Config.init(config, 'synchronizer-config-schema.yaml')
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("att-workflow-driver", "att-workflow-driver.xproto"),
+            get_models_fn("olt-service", "volt.xproto"),
+            get_models_fn("../profiles/rcord", "rcord.xproto")
+        ])
+
+        import synchronizers.new_base.modelaccessor
+        from model_policy_att_workflow_driver_service import AttWorkflowDriverServicePolicy, model_accessor
+
+        from mock_modelaccessor import MockObjectList
+        self.MockObjectList = MockObjectList
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+        # Some of the functions we call have side-effects. For example, creating a VSGServiceInstance may lead to creation of
+        # tags. Ideally, this wouldn't happen, but it does. So make sure we reset the world.
+        model_accessor.reset_all_object_stores()
+
+        self.policy = AttWorkflowDriverServicePolicy()
+
+        self.service = AttWorkflowDriverService(
+            id = 5367,
+            whitelist_entries = [],
+        )
+
+        # needs to be enabled
+        self.si1 = AttWorkflowDriverServiceInstance(
+            valid="awaiting",
+            serial_number="BRCM111"
+        )
+
+        # needs to be enabled
+        self.si2 = AttWorkflowDriverServiceInstance(
+            valid="invalid",
+            serial_number="BRCM222"
+        )
+
+        # remains disabled
+        self.si3 = AttWorkflowDriverServiceInstance(
+            valid="invalid",
+            serial_number="BRCM333"
+        )
+
+        # needs to be disabled
+        self.si4 = AttWorkflowDriverServiceInstance(
+            valid="valid",
+            serial_number="BRCM444"
+        )
+
+    def tearDown(self):
+        sys.path = self.sys_path_save
+        self.service = None
+
+    def test_whitelist_update(self):
+        """
+        When the whitelist is updated, check for added ONU to be enabled and for removed ONU to be disabled
+        """
+        with patch.object(AttWorkflowDriverServiceInstance.objects, "get_items") as oss_si, \
+            patch.object(self.si1, "save") as si1_save, \
+            patch.object(self.si2, "save") as si2_save, \
+            patch.object(self.si3, "save") as si3_save, \
+            patch.object(self.si4, "save") as si4_save:
+            oss_si.return_value = [self.si1, self.si2, self.si3, self.si4]
+
+            wle1 = AttWorkflowDriverWhiteListEntry(owner_id=self.service.id, serial_number="BRCM111")
+            wle2 = AttWorkflowDriverWhiteListEntry(owner_id=self.service.id, serial_number="BRCM222")
+            self.service.whitelist_entries = self.MockObjectList([wle1, wle2])
+
+            self.policy.handle_update(self.service)
+
+            self.si1.save.assert_called_with(always_update_timestamp=True, update_fields=['valid', 'no_sync', 'updated'])
+            self.assertEqual(self.si1.valid, "valid")
+            self.si2.save.assert_called_with(always_update_timestamp=True, update_fields=['valid', 'no_sync', 'updated'])
+            self.assertEqual(self.si2.valid, "valid")
+            self.si3.save.assert_not_called()
+            self.assertEqual(self.si3.valid, "invalid")
+            self.si4.save.assert_called_with(always_update_timestamp=True, update_fields=['valid', 'no_sync', 'updated'])
+            self.assertEqual(self.si4.valid, "invalid")
+
+if __name__ == '__main__':
+    unittest.main()
+
diff --git a/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_serviceinstance.py b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_serviceinstance.py
new file mode 100644
index 0000000..a34fedc
--- /dev/null
+++ b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_serviceinstance.py
@@ -0,0 +1,284 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import unittest
+from mock import patch, call, Mock, PropertyMock
+
+import os, sys
+
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+service_dir=os.path.join(test_path, "../../../..")
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir=os.path.join(xos_dir, "../../xos_services")
+
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+
+class TestModelPolicyAttWorkflowDriverServiceInstance(unittest.TestCase):
+    def setUp(self):
+
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        config = os.path.join(test_path, "../test_config.yaml")
+        from xosconfig import Config
+        Config.clear()
+        Config.init(config, 'synchronizer-config-schema.yaml')
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("att-workflow-driver", "att-workflow-driver.xproto"),
+            get_models_fn("olt-service", "volt.xproto"),
+            get_models_fn("../profiles/rcord", "rcord.xproto")
+        ])
+
+        import synchronizers.new_base.modelaccessor
+        from model_policy_att_workflow_driver_serviceinstance import AttWorkflowDriverServiceInstancePolicy, model_accessor
+
+        from mock_modelaccessor import MockObjectList
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+        # Some of the functions we call have side-effects. For example, creating a VSGServiceInstance may lead to creation of
+        # tags. Ideally, this wouldn't happen, but it does. So make sure we reset the world.
+        model_accessor.reset_all_object_stores()
+
+        self.policy = AttWorkflowDriverServiceInstancePolicy()
+        self.si = AttWorkflowDriverServiceInstance()
+        self.si.owner = AttWorkflowDriverService()
+
+    def tearDown(self):
+        sys.path = self.sys_path_save
+        self.si = None
+
+    def test_not_synced(self):
+        self.si.valid = "awaiting"
+        self.si.backend_code = 0
+
+        with patch.object(RCORDSubscriber, "save") as subscriber_save, \
+            patch.object(ONUDevice, "save") as onu_save:
+
+            with self.assertRaises(Exception) as e:
+               self.policy.handle_update(self.si)
+
+            self.assertIn("has not been synced yet", e.exception.message)
+
+    def test_skip_update(self):
+        self.si.valid = "awaiting"
+        self.si.backend_code = 1
+
+        with patch.object(RCORDSubscriber, "save") as subscriber_save, \
+            patch.object(ONUDevice, "save") as onu_save:
+
+            self.policy.handle_update(self.si)
+            subscriber_save.assert_not_called()
+            onu_save.assert_not_called()
+
+    def test_disable_onu(self):
+        self.si.valid = "invalid"
+        self.si.serial_number = "BRCM1234"
+        self.si.backend_code = 1
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber, "save") as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+            subscriber_save.assert_not_called()
+            self.assertEqual(onu.admin_state, "DISABLED")
+            onu_save.assert_called()
+
+    def test_enable_onu(self):
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.c_tag = None
+        self.si.backend_code = 1
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="DISABLED"
+        )
+
+        subscriber = RCORDSubscriber(
+            onu_device=self.si.serial_number,
+            status='pre-provisioned'
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber.objects, "get_items") as subscriber_objects, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+            subscriber_objects.return_value = [subscriber]
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(onu.admin_state, "ENABLED")
+            onu_save.assert_called()
+
+    def test_do_not_create_subscriber(self):
+        self.si.valid = "valid"
+        self.si.backend_code = 1
+        self.si.serial_number = "BRCM1234"
+        self.si.authentication_state = "DENIEND"
+        self.si.owner.leaf_model.create_on_discovery = False
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="DISABLED"
+        )
+        
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+
+            self.assertEqual(onu.admin_state, "ENABLED")
+            onu_save.assert_called()
+            self.assertEqual(subscriber_save.call_count, 0)
+
+    def test_create_subscriber(self):
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.backend_code = 1
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="ENABLED"
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(subscriber_save.call_count, 1)
+
+            subscriber = subscriber_save.call_args[0][0]
+            self.assertEqual(subscriber.onu_device, self.si.serial_number)
+
+            onu_save.assert_not_called()
+    
+    def test_create_subscriber_no_create_on_discovery(self):
+        """
+        test_create_subscriber_no_create_on_discovery
+        When si.owner.create_on_discovery = False we still need to create the subscriber after authentication
+        """
+
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.backend_code = 1
+        self.si.owner.leaf_model.create_on_discovery = False
+        self.si.authentication_state = "APPROVED"
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="ENABLED"
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(subscriber_save.call_count, 1)
+
+            subscriber = subscriber_save.call_args[0][0]
+            self.assertEqual(subscriber.onu_device, self.si.serial_number)
+
+            onu_save.assert_not_called()
+
+    def test_create_subscriber_with_ctag(self):
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.c_tag = 111
+        self.si.backend_code = 1
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="ENABLED"
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(subscriber_save.call_count, 1)
+
+            subscriber = subscriber_save.call_args[0][0]
+            self.assertEqual(subscriber.onu_device, self.si.serial_number)
+            self.assertEqual(subscriber.c_tag, self.si.c_tag)
+
+            onu_save.assert_not_called()
+
+    def _test_add_c_tag_to_pre_provisioned_subscriber(self):
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.c_tag = 111
+        self.si.backend_code = 1
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number,
+            admin_state="ENABLED"
+        )
+
+        subscriber = RCORDSubscriber(
+            onu_device=self.si.serial_number,
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+                patch.object(RCORDSubscriber.objects, "get_items") as subscriber_objects, \
+                patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+                patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+            subscriber_objects.return_value = [subscriber]
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(subscriber_save.call_count, 1)
+
+            subscriber = subscriber_save.call_args[0][0]
+            self.assertEqual(subscriber.onu_device, self.si.serial_number)
+            self.assertEqual(subscriber.c_tag, self.si.c_tag)
+
+            onu_save.assert_not_called()
+
+if __name__ == '__main__':
+    unittest.main()
+
diff --git a/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_whitelistentry.py b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_whitelistentry.py
new file mode 100644
index 0000000..73c077a
--- /dev/null
+++ b/xos/synchronizer/model_policies/test_model_policy_att_workflow_driver_whitelistentry.py
@@ -0,0 +1,106 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import unittest
+from mock import patch, call, Mock, PropertyMock
+
+import os, sys
+
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+service_dir=os.path.join(test_path, "../../../..")
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir=os.path.join(xos_dir, "../../xos_services")
+
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+
+class TestModelPolicyAttWorkflowDriverWhiteListEntry(unittest.TestCase):
+    def setUp(self):
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        config = os.path.join(test_path, "../test_config.yaml")
+        from xosconfig import Config
+        Config.clear()
+        Config.init(config, 'synchronizer-config-schema.yaml')
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("att-workflow-driver", "att-workflow-driver.xproto"),
+            get_models_fn("olt-service", "volt.xproto"),
+            get_models_fn("../profiles/rcord", "rcord.xproto")
+        ])
+
+        import synchronizers.new_base.modelaccessor
+        from model_policy_att_workflow_driver_whitelistentry import AttWorkflowDriverWhiteListEntryPolicy, model_accessor
+
+        from mock_modelaccessor import MockObjectList
+        self.MockObjectList = MockObjectList
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+        # Some of the functions we call have side-effects. For example, creating a VSGServiceInstance may lead to creation of
+        # tags. Ideally, this wouldn't happen, but it does. So make sure we reset the world.
+        model_accessor.reset_all_object_stores()
+
+        self.policy = AttWorkflowDriverWhiteListEntryPolicy()
+
+        self.service = AttWorkflowDriverService()
+
+
+    def tearDown(self):
+        sys.path = self.sys_path_save
+        self.service = None
+
+    def test_whitelist_update(self):
+        """
+        When a whitelist entry is added, see that the AttWorkflowDriverIServicenstance was set to valid
+        """
+        with patch.object(AttWorkflowDriverServiceInstance.objects, "get_items") as oss_si_items:
+            si = AttWorkflowDriverServiceInstance(serial_number="BRCM333", owner_id=self.service.id, valid="invalid")
+            oss_si_items.return_value = [si]
+
+            wle = AttWorkflowDriverWhiteListEntry(serial_number="BRCM333", owner_id=self.service.id, owner=self.service)
+
+            self.policy.handle_update(wle)
+
+            self.assertEqual(si.valid, "valid")
+
+    def test_whitelist_delete(self):
+        """
+        When a whitelist entry is deleted, see that the AttWorkflowDriverIServicenstance was set to invalid
+        """
+        with patch.object(AttWorkflowDriverServiceInstance.objects, "get_items") as oss_si_items:
+            si = AttWorkflowDriverServiceInstance(serial_number="BRCM333", owner_id=self.service.id, valid="valid")
+            oss_si_items.return_value = [si]
+
+            wle = AttWorkflowDriverWhiteListEntry(serial_number="BRCM333", owner_id=self.service.id, owner=self.service)
+
+            self.policy.handle_delete(wle)
+
+            self.assertEqual(si.valid, "invalid")
+
+if __name__ == '__main__':
+    unittest.main()
+
diff --git a/xos/synchronizer/models/att-workflow-driver.xproto b/xos/synchronizer/models/att-workflow-driver.xproto
new file mode 100644
index 0000000..046e7f5
--- /dev/null
+++ b/xos/synchronizer/models/att-workflow-driver.xproto
@@ -0,0 +1,28 @@
+option name = "att-workflow-driver";
+option app_label = "att-workflow-driver";
+
+message AttWorkflowDriverService (Service){
+    option verbose_name = "AttWorkflowDriver Service";
+    option kind = "OSS";
+
+    required bool create_on_discovery = 2 [help_text = "Whether to create the subscriber when an ONU is discovered", null = False, db_index = False, blank = False, default = True];
+}
+
+message AttWorkflowDriverServiceInstance (ServiceInstance){
+    option owner_class_name = "AttWorkflowDriverService";
+    option verbose_name = "AttWorkflowDriver Service Instance";
+
+    required string valid = 1 [default = "awaiting", choices = "(('awaiting', 'Awaiting Validation'), ('valid', 'Valid'), ('invalid', 'Invalid'))", help_text = "Wether this ONU has been validated by the external OSS", null = False, blank = False];
+    required string serial_number = 2 [max_length = 254, null = False, db_index = False, blank = False, tosca_key=True, unique = True];
+    required string authentication_state = 3 [default = "AWAITING", choices = "(('AWAITING', 'Awaiting'), ('STARTED', 'Started'), ('REQUESTED', 'Requested'), ('APPROVED', 'Approved'), ('DENIED', 'Denied'), )", max_length = 50, null = False, db_index = False, blank = False];
+    required string of_dpid = 4 [max_length = 254, null = False, db_index = False, blank = False];
+    optional int32 c_tag = 5 [null = True, db_index = False, blank = False, unique = True, feedback_state = True];
+}
+
+message AttWorkflowDriverWhiteListEntry (XOSBase) {
+    option verbose_name = "Whitelist";
+    option plural = "attworkflowdriverwhitelistentries";
+
+    required manytoone owner->AttWorkflowDriverService:whitelist_entries = 1 [db_index = True, null = False, blank = False, tosca_key=True];
+    required string serial_number = 2 [max_length = 254, null = False, db_index = False, blank = False, tosca_key=True, unique_with = "owner"];
+}
diff --git a/xos/synchronizer/steps/sync_att_workflow_driver_service_instance.py b/xos/synchronizer/steps/sync_att_workflow_driver_service_instance.py
new file mode 100644
index 0000000..d2fdeeb
--- /dev/null
+++ b/xos/synchronizer/steps/sync_att_workflow_driver_service_instance.py
@@ -0,0 +1,63 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import json
+from synchronizers.new_base.syncstep import SyncStep, model_accessor
+from synchronizers.new_base.modelaccessor import AttWorkflowDriverServiceInstance, AttWorkflowDriverWhiteListEntry
+
+from xosconfig import Config
+from multistructlog import create_logger
+
+log = create_logger(Config().get('logging'))
+
+class SyncAttWorkflowDriverServiceInstance(SyncStep):
+    provides = [AttWorkflowDriverServiceInstance]
+    observes = AttWorkflowDriverServiceInstance
+
+    def validate_in_external_oss(self, si):
+        # This is where you may want to call your OSS Database to verify if this ONU can be activated
+        oss_service = si.owner.leaf_model
+
+        # See if there is a matching entry in the whitelist.
+
+        matching_entries = AttWorkflowDriverWhiteListEntry.objects.filter(owner_id=oss_service.id,
+                                                                  serial_number=si.serial_number)
+
+        return len(matching_entries)>0
+
+    def get_suscriber_c_tag(self, serial_number):
+        # If it's up to your OSS to generate c_tags, fetch them here
+        # otherwise XOS will generate one for your subscriber
+        return None
+
+    def sync_record(self, o):
+        log.info("synching AttWorkflowDriverServiceInstance", object=str(o), **o.tologdict())
+
+        if not self.validate_in_external_oss(o):
+            log.error("ONU with serial number %s is not valid in the OSS Database" % o.serial_number)
+            o.valid = "invalid"
+        else:
+            if self.get_suscriber_c_tag(o.serial_number):
+                self.c_tag = self.get_suscriber_c_tag(o.serial_number)
+
+            o.valid = "valid"
+
+        # Set no_sync=True to prevent the syncstep from running again, and set alway_update_timestamp=True to cause
+        # the model_policy to run again.
+        # TODO(smbaker): Revisit this after fixing this issue in the core.
+        o.no_sync = True
+        o.save(update_fields=["valid", "no_sync", "updated"], always_update_timestamp=True)
+
+    def delete_record(self, o):
+        pass
diff --git a/xos/synchronizer/steps/test_sync_att_workflow_driver_service_instance.py b/xos/synchronizer/steps/test_sync_att_workflow_driver_service_instance.py
new file mode 100644
index 0000000..db168f7
--- /dev/null
+++ b/xos/synchronizer/steps/test_sync_att_workflow_driver_service_instance.py
@@ -0,0 +1,114 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import unittest
+
+import functools
+from mock import patch, call, Mock, PropertyMock
+import requests_mock
+import multistructlog
+from multistructlog import create_logger
+
+import os, sys
+
+# Hack to load synchronizer framework
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir = os.path.join(xos_dir, "../../xos_services")
+sys.path.append(xos_dir)
+sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+# END Hack to load synchronizer framework
+
+# generate model from xproto
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    else:
+        name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+        if os.path.exists(os.path.join(services_dir, name)):
+            return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+# END generate model from xproto
+
+class TestSyncAttWorkflowDriverServiceInstance(unittest.TestCase):
+
+    def setUp(self):
+
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        # Setting up the config module
+        from xosconfig import Config
+        config = os.path.join(test_path, "../test_config.yaml")
+        Config.clear()
+        Config.init(config, "synchronizer-config-schema.yaml")
+        # END Setting up the config module
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("att-workflow-driver", "att-workflow-driver.xproto"),
+            get_models_fn("olt-service", "volt.xproto"),
+            get_models_fn("../profiles/rcord", "rcord.xproto")
+        ])
+        import synchronizers.new_base.modelaccessor
+
+        from sync_att_workflow_driver_service_instance import SyncAttWorkflowDriverServiceInstance, model_accessor
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+
+        self.sync_step = SyncAttWorkflowDriverServiceInstance
+
+        self.oss = Mock()
+        self.oss.name = "oss"
+        self.oss.id = 5367
+
+        # create a mock AttWorkflowDriverServiceInstance instance
+        self.o = Mock()
+        self.o.serial_number = "BRCM1234"
+        self.o.of_dpid = "of:109299321"
+        self.o.owner.leaf_model = self.oss
+        self.o.tologdict.return_value = {}
+
+    def tearDown(self):
+        self.o = None
+        sys.path = self.sys_path_save
+
+    def test_sync_valid(self):
+        with patch.object(AttWorkflowDriverWhiteListEntry.objects, "get_items") as whitelist_items:
+            # Create a whitelist entry for self.o's serial number
+            whitelist_entry = AttWorkflowDriverWhiteListEntry(owner_id=self.oss.id, serial_number=self.o.serial_number)
+            whitelist_items.return_value = [whitelist_entry]
+
+            self.sync_step().sync_record(self.o)
+
+            self.assertEqual(self.o.valid, "valid")
+            self.assertTrue(self.o.no_sync)
+            self.o.save.assert_called()
+
+    def test_sync_rejected(self):
+        self.sync_step().sync_record(self.o)
+
+        self.assertEqual(self.o.valid, "invalid")
+        self.assertTrue(self.o.no_sync)
+        self.o.save.assert_called()
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/xos/synchronizer/test_config.yaml b/xos/synchronizer/test_config.yaml
new file mode 100644
index 0000000..dfb11c7
--- /dev/null
+++ b/xos/synchronizer/test_config.yaml
@@ -0,0 +1,31 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+name: test-AttWorkflowDriverService-config
+accessor:
+  username: xosadmin@opencord.org
+  password: "sample"
+  kind: "testframework"
+logging:
+  version: 1
+  handlers:
+    console:
+      class: logging.StreamHandler
+  loggers:
+    'multistructlog':
+      handlers:
+          - console
+#      level: DEBUG