Add user attribute push rules documentation

product/admin/attribute-push-rules.mdx

@@ -0,0 +1,113 @@
+---
+title: "User attribute push rules"
+description: "User attribute push rules allow you to automatically sync user attributes from ConductorOne to your connected applications. This ensures that user data stays consistent across your integrated systems."
+---
+
+## Overview
+
+Attribute push rules give you control over which user attributes are synchronized to specific applications and how they're mapped. With these rules, you can sync ConductorOne attributes to application user profiles and transform attribute values using expressions. You can also target specific users based on conditions and map to both standard and custom attributes when supported by the connector.
+
+## When to use attribute push rules
+
+Use attribute push rules when you need to keep user profile data synchronized across applications or populate custom user fields in connected applications. They're also helpful for maintaining consistent user attributes for compliance or operational purposes, as well as transforming or deriving attribute values before syncing to applications.
+
+## How attribute push works
+
+When you create a push rule configuration:
+
+1. Select the connector you want to push attributes to
+2. Map ConductorOne attributes to the target application's user attributes
+3. Optionally, use CEL expressions to transform values
+4. Choose which users to target (all users or specific users)
+5. Enable the configuration to begin syncing
+
+Attributes are pushed to the connected application automatically when:
+
+- The push configuration is created or updated
+- A user's attribute values change in ConductorOne
+- You manually trigger a push
+
+## Configure attribute push rules
+
+### Prerequisites
+
+- Admin permissions in ConductorOne
+- A configured connector for the target application
+- User attribute mappings defined in ConductorOne (Admin \> Settings \> User data sources)
+
+### Create a push rule
+
+1. Navigate to **Admin \> Settings \> User data sources**
+2. Select the **Push rules** tab
+3. Click **Add push rule**
+4. Select the connector you want to push attributes to
+5. For each attribute you want to sync:
+   - Choose the target attribute name from the connector's available attributes
+   - Select a ConductorOne attribute to map, or write a CEL expression for custom logic
+   - If the connector supports custom attributes, you can specify a custom name
+6. Under **User targeting**, choose:
+   - **All users**: Push attributes for all users in your tenant
+   - **Specific users**: Use a CEL expression to target users matching specific criteria
+7. Enable the push rule
+8. Click **Save**
+
+### Edit or disable a push rule
+
+1. Navigate to **Admin \> Settings \> User data sources \> Push rules**
+2. Find the push rule in the list
+3. Click the menu button (...) and select:
+   - **Edit**: Modify attribute mappings or user targeting
+   - **Enable** or **Disable**: Turn the push rule on or off
+   - **Delete**: Remove the push rule completely
+
+## Attribute mappings
+
+### Map to ConductorOne attributes
+
+Select a ConductorOne attribute from the dropdown to sync its value directly to the target application.
+
+**Example**: Map the `Department` attribute in ConductorOne to the `department` field in the target application.
+
+### Use CEL expressions
+
+For more advanced scenarios, you can use CEL (Common Expression Language) expressions to transform or derive attribute values.
+
+**Example**: Combine first and last name into a display name
+
+```cel
+user.first_name + " " + user.last_name
+```
+
+**Example**: Set a value based on a condition
+
+```cel
+user.department == "Engineering" ? "tech@company.com" : "general@company.com"
+```
+
+## User targeting
+
+### All users
+
+Syncs attributes for all users in your ConductorOne tenant.
+
+### Specific users (CEL expression)
+
+Use a CEL expression to target specific users based on their attributes.
+
+**Example**: Target only active employees
+
+```cel
+user.status == "active" && user.employment_type == "full_time"
+```
+
+**Example**: Target users in specific departments
+
+```cel
+user.department in ["Engineering", "Product", "Design"]
+```
+
+## Custom attributes
+
+Some connectors support pushing to custom attributes that aren't part of the standard user schema. When configuring a push rule for these connectors, you can specify custom attribute names.
+
+Check the connector's schema to see if custom attributes are supported.