Skip to main content
InternalMarkdown

ADR 0014. Provider Aliases Are Provider-Operator Scoped

Status​

Accepted.

Supersedes the earlier open-question resolution that "no third scope type is needed." Default: a provider-global player alias is not permitted.

Context​

A provider may serve many operators. If PlayerPal issued one pp_plr_prv_... per provider, that provider could correlate the same person across casinos. An untrusted payload field claiming an operator would let a provider submit another audience's activity.

Decision​

Each provider player alias is scoped to one configured provider-operator integration (pp_int_...). The same player at Provider A × Operator A and Provider A × Operator B receives two different pp_plr_prv_... values.

Provider/operator scope is taken from authenticated integration configuration, credentials, certificate or upload location, not from a free-text payload field alone.

Cross-audience alias use returns the same response as an unknown alias.

Provider-global aliases are an explicit contract exception only; the default and implementation posture remain integration-scoped. Do not mint or resolve a provider-global alias without that exception recorded for the provider.

Current exception list: none. A named provider may be added only by a new ADR plus an explicit contract. A provider-global cohort is a different decision (ADR 0026).

Consequences​

  • Link-result exchange can return requested provider aliases for integrations already authorized for that operator (spec §37.4).
  • Ingestion resolves aliases only inside the authenticated integration's audience (spec §12).
  • See docs/identity.md and spec §11.