The preferred mode of operation is that NSO is the only "thing" (including systems and people) that configures the device. So then you do a sync from when you first connect to the device, and then you can assume that NSO is always in sync with the device. This means that when NSO calculates the minimal configuration to send to the device, it knows what is already there. NSO will do a check-sync as the first stage of any transaction, so if someone/something else has configured the device, then the transaction will fail. You can then inspect the delta, and decide if you want to accept waht's on the device (sync-from), overwrite it (sync-to), or ignore it (commit without sync check). This is the safest way to operate.
There are of course less safe ways :-)
