# ADR 0014. Provider Aliases Are Provider-Operator Scoped

## Status
Accepted.

Supersedes the earlier open-question resolution that "no third scope type is
needed." Default: a provider-global player alias is not permitted.

## Context
A provider may serve many operators. If PlayerPal issued one `pp_plr_prv_...`
per provider, that provider could correlate the same person across casinos.
An untrusted payload field claiming an operator would let a provider submit
another audience's activity.

## Decision
Each provider player alias is scoped to one configured provider-operator
integration (`pp_int_...`). The same player at Provider A × Operator A and
Provider A × Operator B receives two different `pp_plr_prv_...` values.

Provider/operator scope is taken from authenticated integration configuration,
credentials, certificate or upload location, not from a free-text payload
field alone.

Cross-audience alias use returns the same response as an unknown alias.

Provider-global aliases are an explicit **contract exception** only; the
default and implementation posture remain integration-scoped. Do not mint
or resolve a provider-global alias without that exception recorded for the
provider.

**Current exception list: none.** A named provider may be added only by a
new ADR plus an explicit contract. A provider-global **cohort** is a
different decision ([ADR 0026](0026-analytics-subject-and-provider-cohort.md)).

## Consequences
- Link-result exchange can return requested provider aliases for integrations
  already authorized for that operator (spec §37.4).
- Ingestion resolves aliases only inside the authenticated integration's
  audience (spec §12).
- See [docs/identity.md](../identity.md) and spec §11.