Add 'export-only' attribute flow option for one-time provisioning

[JayVDZ]

Summary

Add support for attribute flows that are only evaluated during export to a Connected System and marked as unmanaged after the first successful application, preventing further synchronisation updates to that attribute on the Connected System Object.

Description

This feature allows administrators to configure specific attribute flows in export sync rules to be applied only once to a Connected System. After the attribute is successfully provisioned/exported to the Connected System, the attribute becomes unmanaged by JIM, allowing external systems to own and modify that attribute value independently.

Use Cases

• Temporary credentials or tokens: Set an initial password or API token once, then let the system manage future updates
• One-time setup attributes: Attributes that should only be configured during initial provisioning
• External system ownership: Allow external systems to take ownership of specific attributes after initial sync

Proposed Solution

Add an "Export Only" toggle option for individual attribute mappings in export sync rules:

Attribute Mapping
[MV Attribute] >> [CS Attribute]
☐ Export Only (once provisioned, attribute becomes unmanaged)

When enabled for an attribute:

1. The attribute flow is only evaluated during export operations
2. After successful export to a Connected System Object, the attribute is marked as unmanaged
3. Future changes to the Metaverse Object for this attribute are not synced to the Connected System
4. The attribute can be manually managed or modified in the external system without conflicts

Technical Considerations

• May require a flag or state on the CSO to track "managed" vs "unmanaged" attributes per attribute
• Filtering logic needed during export to skip unmanaged attributes
• Schema tracking to understand which attributes are managed per sync rule per CSO

Acceptance Criteria

• "Export Only" option is available on attribute mappings in export sync rules
• Selected attribute flows are evaluated once during export
• Successfully exported attributes are marked as unmanaged for that CSO
• Future Metaverse Object changes to unmanaged attributes are not exported
• Attribute can be manually edited in the external system after initial export without JIM re-syncing
• Import rules continue to work independently (can still import updates from the attribute)
• UI clearly indicates which attributes are managed vs unmanaged on a CSO