add hints on when to handle events

content/en/docs/connect_manage_environ/connected_agent_common_reference/custom-external-credentials.md

@@ -31,6 +31,37 @@ Each agent will support setting a custom credential differently, please see the
 
 In both cases, Watch Topic or Webhook, the integration should be setup for create, update, and delete events on the Credential resource in your specific Environment.
 
+Upon receiving an event the process should check a few data points to know that it should handle the event.
+
+Handle provisioning a new credential when...
+
+* The Credential resource references the custom Credential Request Definition
+    * Check `spec.credentialRequestDefinition` for the referenced Credential Request Definition
+* The Credential resource has a desired state of `active`
+    * Check `spec.state.name` for the desired state
+* The Credential resource has a `Pending` status
+    * Check `status.level` for the status
+* The Credential does not have the finalizer that the process will add
+
+Handle a credential update event when...
+
+* The Credential resource references the custom Credential Request Definition
+    * Check `spec.credentialRequestDefinition` for the referenced Credential Request Definition
+* The Credential resource has a `Pending` status
+    * Check `status.level` for the status
+* The Credential has the finalizer that the process adds
+* If the `state.name` is `active` and the `spec.state.name` is `inactive` the Credential should be disabled
+* If the `state.name` is `inactive` and the `spec.state.name` is `active` the Credential should be enabled
+* If `state.name` and `spec.state.name` are `active` and `spec.state.rotate` is true then the Credential should be rotated
+
+Handle a credential delete event when...
+
+* The Credential resource references the custom Credential Request Definition
+    * Check `spec.credentialRequestDefinition` for the referenced Credential Request Definition
+* The Credential has the finalizer that the process adds
+* The Credential is marked as `DELETING`
+    * Check the `metadata.state` value for `DELETING`
+
 ### Integrate using a Watch Topic
 
 See [Set up integrations through Watch Topics](/docs/integrate_with_central/integrate-with-watchtopics) for a full description of setting up Watch Topics.
@@ -140,4 +171,8 @@ The last API call made must *always* be the status sub-resource
         "level": "Success"
     }
 }
-```
+```
+
+### Deleting the Credential resource
+
+If the process is handling a delete event the only step that needs to be taken on the resource, after successful handling, is to remove the finalizer that the process added. Doing so will inform Amplify that the Credential resource may be completely removed from the system.