diff --git a/Dockerfile.synchronizer b/Dockerfile.synchronizer
index ec224d8..ebc879e 100644
--- a/Dockerfile.synchronizer
+++ b/Dockerfile.synchronizer
@@ -12,7 +12,9 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# xosproject/volt-synchronizer
+# docker build -t xosproject/hippie-oss-synchronizer:candidate -f Dockerfile.synchronizer .
+
+# xosproject/hippie-oss-synchronizer
 
 FROM xosproject/xos-synchronizer-base:candidate
 
diff --git a/docs/README.md b/docs/README.md
index addcf61..7f47c3c 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -5,7 +5,7 @@
 
 Peace and Love
 
-> NOTE: This service depends on RCORDSubscriber so make sure that the `rcord-synchronizer` is running
+> NOTE: This service depends on RCORDSubscriber and ONUDevice so make sure that the `rcord-synchronizer` and `volt-synchronizer` are running
 
 ## How to install this service
 
diff --git a/samples/oss-service-instance-invalid.yaml b/samples/oss-service-instance-invalid.yaml
new file mode 100644
index 0000000..5bca7fb
--- /dev/null
+++ b/samples/oss-service-instance-invalid.yaml
@@ -0,0 +1,38 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# curl -H "xos-username: admin@opencord.org" -H "xos-password: letmein" -X POST --data-binary @oss-service-instance-invalid.yaml http://192.168.99.100:30007/run
+
+tosca_definitions_version: tosca_simple_yaml_1_0
+imports:
+  - custom_types/hippieossservice.yaml
+  - custom_types/hippieossserviceinstance.yaml
+description: Emulate the call for an INVALID ONU
+topology_template:
+  node_templates:
+    service#oss:
+      type: tosca.nodes.HippieOSSService
+      properties:
+        name: hippie-oss
+        must-exist: true
+        blacklist: 845f10885b5c479daab9e825c1f4ced8 # NOTE: this ONU must exist in the system (check in olt-service examples to create it)
+
+    oss_si:
+      type: tosca.nodes.HippieOSSServiceInstance
+      properties:
+        name: Invalid ONU example
+        of_dpid: "of:1234"
+        serial_number: 845f10885b5c479daab9e825c1f4ced8
+        uni_port_id: 16
+
diff --git a/samples/oss-service-instance-valid.yaml b/samples/oss-service-instance-valid.yaml
new file mode 100644
index 0000000..c840d10
--- /dev/null
+++ b/samples/oss-service-instance-valid.yaml
@@ -0,0 +1,38 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# curl -H "xos-username: admin@opencord.org" -H "xos-password: letmein" -X POST --data-binary @oss-service-instance-valid.yaml http://192.168.99.100:30007/run
+
+tosca_definitions_version: tosca_simple_yaml_1_0
+imports:
+  - custom_types/hippieossservice.yaml
+  - custom_types/hippieossserviceinstance.yaml
+description: Emulate the call for an VALID ONU
+topology_template:
+  node_templates:
+    service#oss:
+      type: tosca.nodes.HippieOSSService
+      properties:
+        name: hippie-oss
+        must-exist: true
+        blacklist: ""
+
+    oss_si:
+      type: tosca.nodes.HippieOSSServiceInstance
+      properties:
+        name: valid ONU example
+        of_dpid: "of:1234"
+        serial_number: BRCM1234
+        uni_port_id: 16
+
diff --git a/samples/oss-service.yaml b/samples/oss-service.yaml
index 359de20..8f77ee8 100644
--- a/samples/oss-service.yaml
+++ b/samples/oss-service.yaml
@@ -33,6 +33,7 @@
       properties:
         name: hippie-oss
         kind: oss
+        # blacklist: BRCM1234, BRCM4321 # this is an optional list of ONUs that you don't want to validate
 
     service_dependency#oss_volt:
       type: tosca.nodes.ServiceDependency
diff --git a/xos/synchronizer/model_policies/model_policy_hippieossserviceinstance.py b/xos/synchronizer/model_policies/model_policy_hippieossserviceinstance.py
index 543c0df..31c2290 100644
--- a/xos/synchronizer/model_policies/model_policy_hippieossserviceinstance.py
+++ b/xos/synchronizer/model_policies/model_policy_hippieossserviceinstance.py
@@ -14,7 +14,7 @@
 # limitations under the License.
 
 
-from synchronizers.new_base.modelaccessor import RCORDSubscriber, model_accessor
+from synchronizers.new_base.modelaccessor import RCORDSubscriber, ONUDevice, model_accessor
 from synchronizers.new_base.policy import Policy
 
 class OSSServiceInstancePolicy(Policy):
@@ -22,12 +22,18 @@
 
     def handle_update(self, si):
         self.logger.debug("MODEL_POLICY: handle_update for HippieOSSServiceInstance %s " % si.id)
-        if not si.valid:
-            # NOTE we don't do anything if the ONU has not been activated
-            self.logger.debug("MODEL_POLICY: skipping handle_update for HippieOSSServiceInstance %s as valid is %s" % (si.id, si.valid))
-            pass
-        else:
-            self.logger.debug("MODEL_POLICY: creating RCORDSubscriber for HippieOSSServiceInstance %s as valid is %s" % (si.id, si.valid))
+
+        if not hasattr(si, 'valid') or si.valid is "awaiting":
+            self.logger.debug("MODEL_POLICY: skipping handle_update for HippieOSSServiceInstance %s as not validated yet" % si.id)
+            return
+        if si.valid == "invalid":
+            self.logger.debug("MODEL_POLICY: disabling ONUDevice [%s] for HippieOSSServiceInstance %s" % (si.serial_number, si.id))
+            onu = ONUDevice.objects.get(serial_number=si.serial_number)
+            onu.admin_state = "DISABLED"
+            onu.save(always_update_timestamp=True)
+            return
+        if si.valid == "valid":
+            self.logger.debug("MODEL_POLICY: creating RCORDSubscriber for HippieOSSServiceInstance %s" % si.id)
             subscriber = RCORDSubscriber()
             subscriber.onu_device = si.serial_number
             subscriber.uni_port_id = si.uni_port_id
@@ -37,6 +43,7 @@
                 subscriber.c_tag = si.c_tag
 
             subscriber.save()
+            return
 
     def handle_delete(self, si):
         pass
diff --git a/xos/synchronizer/model_policies/test_model_policy_hippieossserviceinstance.py b/xos/synchronizer/model_policies/test_model_policy_hippieossserviceinstance.py
new file mode 100644
index 0000000..07847b2
--- /dev/null
+++ b/xos/synchronizer/model_policies/test_model_policy_hippieossserviceinstance.py
@@ -0,0 +1,148 @@
+
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+import unittest
+from mock import patch, call, Mock, PropertyMock
+
+import os, sys
+
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+service_dir=os.path.join(test_path, "../../../..")
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir=os.path.join(xos_dir, "../../xos_services")
+
+# While transitioning from static to dynamic load, the path to find neighboring xproto files has changed. So check
+# both possible locations...
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    else:
+        name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+        if os.path.exists(os.path.join(services_dir, name)):
+            return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+
+class TestModelPolicyHippieOssServiceInstance(unittest.TestCase):
+    def setUp(self):
+        global VOLTServiceInstancePolicy, MockObjectList
+
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        config = os.path.join(test_path, "../test_config.yaml")
+        from xosconfig import Config
+        Config.clear()
+        Config.init(config, 'synchronizer-config-schema.yaml')
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("hippie-oss", "hippie-oss.xproto"),
+            get_models_fn("olt-service", "volt.xproto"),
+            get_models_fn("../profiles/rcord", "rcord.xproto")
+        ])
+
+        import synchronizers.new_base.modelaccessor
+        from model_policy_hippieossserviceinstance import OSSServiceInstancePolicy, RCORDSubscriber, ONUDevice, model_accessor
+
+        from mock_modelaccessor import MockObjectList
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+        # Some of the functions we call have side-effects. For example, creating a VSGServiceInstance may lead to creation of
+        # tags. Ideally, this wouldn't happen, but it does. So make sure we reset the world.
+        model_accessor.reset_all_object_stores()
+
+        self.policy = OSSServiceInstancePolicy()
+        self.si = Mock()
+
+    def tearDown(self):
+        sys.path = self.sys_path_save
+        self.si = None
+
+    def test_skip_update(self):
+        self.si.valid = "awaiting"
+
+        with patch.object(RCORDSubscriber, "save") as subscriber_save, \
+            patch.object(ONUDevice, "save") as onu_save:
+
+            self.policy.handle_update(self.si)
+            subscriber_save.assert_not_called()
+            onu_save.assert_not_called()
+
+    def test_disable_onu(self):
+        self.si.valid = "invalid"
+        self.si.serial_number = "BRCM1234"
+
+        onu = ONUDevice(
+            serial_number=self.si.serial_number
+        )
+
+        with patch.object(ONUDevice.objects, "get_items") as onu_objects, \
+            patch.object(RCORDSubscriber, "save") as subscriber_save, \
+            patch.object(ONUDevice, "save") as onu_save:
+
+            onu_objects.return_value = [onu]
+
+            self.policy.handle_update(self.si)
+            subscriber_save.assert_not_called()
+            self.assertEqual(onu.admin_state, "DISABLED")
+            onu_save.assert_called()
+
+    def test_create_subscriber(self):
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.uni_port_id = 16
+
+        with patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+            patch.object(ONUDevice, "save") as onu_save:
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(subscriber_save.call_count, 1)
+
+            subscriber = subscriber_save.call_args[0][0]
+            self.assertEqual(subscriber.onu_device, self.si.serial_number)
+            self.assertEqual(subscriber.uni_port_id, self.si.uni_port_id)
+
+            onu_save.assert_not_called()
+
+    def test_create_subscriber_with_ctag(self):
+        self.si.valid = "valid"
+        self.si.serial_number = "BRCM1234"
+        self.si.uni_port_id = 16
+        self.si.c_tag = 111
+
+        with patch.object(RCORDSubscriber, "save", autospec=True) as subscriber_save, \
+            patch.object(ONUDevice, "save") as onu_save:
+
+            self.policy.handle_update(self.si)
+            self.assertEqual(subscriber_save.call_count, 1)
+
+            subscriber = subscriber_save.call_args[0][0]
+            self.assertEqual(subscriber.onu_device, self.si.serial_number)
+            self.assertEqual(subscriber.uni_port_id, self.si.uni_port_id)
+            self.assertEqual(subscriber.c_tag, self.si.c_tag)
+
+            onu_save.assert_not_called()
+
+if __name__ == '__main__':
+    unittest.main()
+
diff --git a/xos/synchronizer/models/hippie-oss.xproto b/xos/synchronizer/models/hippie-oss.xproto
index 558d8b4..671089a 100644
--- a/xos/synchronizer/models/hippie-oss.xproto
+++ b/xos/synchronizer/models/hippie-oss.xproto
@@ -4,13 +4,15 @@
 message HippieOSSService (Service){
     option verbose_name = "HippieOSS Service";
     option kind = "OSS";
+
+    optional string blacklist = 1 [help_text = "A comma separated list of ONUs that are deemed not to be valid ONUs", null = True, db_index = False, blank = False];
 }
 
 message HippieOSSServiceInstance (ServiceInstance){
     option owner_class_name = "HippieOSSService";
     option verbose_name = "HippieOSS Service Instance";
 
-    required bool valid = 1 [help_text = "Wether this ONU has been validated by the external OSS", default = False, null = False, db_index = False, blank = False];
+    required string valid = 1 [default = "awaiting", choices = "(('awaiting', 'Awaiting Validation'), ('valid', 'Valid'), ('invalid', 'Invalid'))", help_text = "Wether this ONU has been validated by the external OSS", null = False, blank = False];
     required string serial_number = 2 [max_length = 254, null = False, db_index = False, blank = False, tosca_key=True, unique = True];
     required int32 uni_port_id = 3 [null = False, db_index = False, blank = False];
     required string of_dpid = 4 [max_length = 254, null = False, db_index = False, blank = False];
diff --git a/xos/synchronizer/steps/sync_hippie_oss_service_instance.py b/xos/synchronizer/steps/sync_hippie_oss_service_instance.py
index 197e26c..e45f058 100644
--- a/xos/synchronizer/steps/sync_hippie_oss_service_instance.py
+++ b/xos/synchronizer/steps/sync_hippie_oss_service_instance.py
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 import json
-from synchronizers.new_base.SyncInstanceUsingAnsible import SyncStep
+from synchronizers.new_base.syncstep import SyncStep, model_accessor
 from synchronizers.new_base.modelaccessor import HippieOSSServiceInstance
 
 from xosconfig import Config
@@ -25,8 +25,15 @@
     provides = [HippieOSSServiceInstance]
     observes = HippieOSSServiceInstance
 
-    def validate_in_external_oss(self, serial_number):
+    def validate_in_external_oss(self, si):
         # This is where you may want to call your OSS Database to verify if this ONU can be activated
+
+        # for demonstration the HippieOSSService has a blacklist and if the serial_number
+        # you provided is in that blacklist, it won't be validated
+        oss_service = si.owner.leaf_model
+
+        if si.serial_number in [x.strip() for x in oss_service.blacklist.split(',')]:
+            return False
         return True
 
     def get_suscriber_c_tag(self, serial_number):
@@ -37,14 +44,14 @@
     def sync_record(self, o):
         log.info("synching HippieOSSServiceInstance", object=str(o), **o.tologdict())
 
-        if not self.validate_in_external_oss(o.serial_number):
-            log.error("ONU with serial number %s is not valid in the OSS Database")
-            return
+        if not self.validate_in_external_oss(o):
+            log.error("ONU with serial number %s is not valid in the OSS Database" % o.serial_number)
+            o.valid = "invalid"
+        else:
+            if self.get_suscriber_c_tag(o.serial_number):
+                self.c_tag = self.get_suscriber_c_tag(o.serial_number)
 
-        if self.get_suscriber_c_tag(o.serial_number):
-            self.c_tag = self.get_suscriber_c_tag(o.serial_number)
-
-        o.valid = True
+            o.valid = "valid"
 
         # FIXME why without this model_policies won't run the handle_update?
         o.no_sync = True
diff --git a/xos/synchronizer/steps/test_sync_hippie_oss_service_instance.py b/xos/synchronizer/steps/test_sync_hippie_oss_service_instance.py
new file mode 100644
index 0000000..c80fa85
--- /dev/null
+++ b/xos/synchronizer/steps/test_sync_hippie_oss_service_instance.py
@@ -0,0 +1,108 @@
+# Copyright 2017-present Open Networking Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import unittest
+
+import functools
+from mock import patch, call, Mock, PropertyMock
+import requests_mock
+import multistructlog
+from multistructlog import create_logger
+
+import os, sys
+
+# Hack to load synchronizer framework
+test_path=os.path.abspath(os.path.dirname(os.path.realpath(__file__)))
+xos_dir=os.path.join(test_path, "../../..")
+if not os.path.exists(os.path.join(test_path, "new_base")):
+    xos_dir=os.path.join(test_path, "../../../../../../orchestration/xos/xos")
+    services_dir = os.path.join(xos_dir, "../../xos_services")
+sys.path.append(xos_dir)
+sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+# END Hack to load synchronizer framework
+
+# generate model from xproto
+def get_models_fn(service_name, xproto_name):
+    name = os.path.join(service_name, "xos", xproto_name)
+    if os.path.exists(os.path.join(services_dir, name)):
+        return name
+    else:
+        name = os.path.join(service_name, "xos", "synchronizer", "models", xproto_name)
+        if os.path.exists(os.path.join(services_dir, name)):
+            return name
+    raise Exception("Unable to find service=%s xproto=%s" % (service_name, xproto_name))
+# END generate model from xproto
+
+class TestSyncHippieOssServiceInstance(unittest.TestCase):
+
+    def setUp(self):
+
+        self.sys_path_save = sys.path
+        sys.path.append(xos_dir)
+        sys.path.append(os.path.join(xos_dir, 'synchronizers', 'new_base'))
+
+        # Setting up the config module
+        from xosconfig import Config
+        config = os.path.join(test_path, "../test_config.yaml")
+        Config.clear()
+        Config.init(config, "synchronizer-config-schema.yaml")
+        # END Setting up the config module
+
+        from synchronizers.new_base.mock_modelaccessor_build import build_mock_modelaccessor
+        build_mock_modelaccessor(xos_dir, services_dir, [
+            get_models_fn("hippie-oss", "hippie-oss.xproto")
+        ])
+        import synchronizers.new_base.modelaccessor
+
+        from sync_hippie_oss_service_instance import SyncOSSServiceInstance, model_accessor
+
+        # import all class names to globals
+        for (k, v) in model_accessor.all_model_classes.items():
+            globals()[k] = v
+
+
+        self.sync_step = SyncOSSServiceInstance
+
+        self.oss = Mock()
+        self.oss.name = "oss"
+        self.oss.blacklist = ""
+
+        # create a mock VRouterStaticRoute instance
+        self.o = Mock()
+        self.o.serial_number = "BRCM1234"
+        self.o.uni_port_id = 16
+        self.o.of_dpid = "of:109299321"
+        self.o.owner.leaf_model = self.oss
+        self.o.tologdict.return_value = {}
+
+    def tearDown(self):
+        self.o = None
+        sys.path = self.sys_path_save
+
+    def test_sync_valid(self):
+
+        self.sync_step().sync_record(self.o)
+
+        self.assertEqual(self.o.valid, "valid")
+        self.assertTrue(self.o.no_sync)
+        self.o.save.assert_called()
+
+    def test_sync_rejected(self):
+        self.oss.blacklist = "BRCM5678, BRCM1234"
+
+        self.sync_step().sync_record(self.o)
+
+        self.assertEqual(self.o.valid, "invalid")
+        self.assertTrue(self.o.no_sync)
+        self.o.save.assert_called()
\ No newline at end of file