What is a resource in OIM - really?

Question

I'm trying to understand what I can do with resources, and how they can be manipulated (especially through the API.)
From the documents, "A resource object is a virtual representation of the target system, and contains all entities related to the external resource." Well, the 2nd part of that sentence seems to be overstating the case - you can create a resource type and create instances of that type, where the type will have user-defined attributes (url, username, etc.)
But still, it seems that the purpose of a resource object is to represent a system, perhaps for the use of reconciliation, but also so that OIM can provision the resource object to users (or groups.)
However, some of my coworkers believe that a resource is more than that. In particular, a resource could represent an arbitrary external entity (let's say, a bit absurdly, a particular automobile), and that there should also be ways to associate operations/permissions with that entity (in this case, "own", "drive", "ride-in", "fix", "sell"), and each operation/permission can be assigned to a user (or group.)
I find no evidence of this type of fine-grained permission-oriented use of resources. Is there a way to handle this type of problem within OIM (9.0.3)? If so, how? Is there something more appropriate than resources?
If it is possible to have operations defined on resources, how would you grant a user a subset of the operations?
And a related question: the API provides what seems to be read-only access to Objects? Is it possible to create Objects through the API? And what is the relationship of Objects to ITResources?
Many thanks for your thoughts and responses!

Answer 1

An IT Resource Type Definition is a type of resource, whether its a database, unix server, Active Directory Domain, Exchange Server, and such.
An IT Resource is a specific instance of a Type, which contains all the connection specific parameters that are passed onto the API calls. If you look at any of the APIs for active directory, it maps the values from the IT Resource to the connection parameters so it can create the connection to Active Directory.
In your example of the automobile, lets say you find a java api, or create one to communicate with an automobile. You have a Type Definition called Automobile, and an IT Resource of specific automobile type, with all the connection parameters you will require when you run your APIs. You would also require a resource object of Automobile type, a process form for the main account, a child table for the permissions, or check boxes, whichever way you would want to select the access rights, and a provisioning process.
So when a request is made for the automobile, the request would specify which specific instance on an IT Resource Lookup field, and however you have defined the access rights, they would select them. When the request is finalized, and provisioning, your APIs would use the IT Resource parameters to establish a connection, and then values from the process form to create the account with the specific rights defined on the form. Then close the connection.
You could also create a generic resource object, that requires no it resource, and it would simply be a place holder for a physical object like a secure id token, or mobile phone. You could just have a provisioning task that requires manual interaction for someone to go in and actually mark the object as "Sent Out" or completed.
Currently you cannot create an object through an API. They are only available during the Import, or creating with the design console.
-Kevin