ADR 0020. Assurance Levels A0-A3; Password-Only Is Provisional
Status
Accepted.
Amendment (ADR 0022 / 0024): PlayerPal ID + password is offered on the player portal (provisional A0). Create and sign-in are Nest-owned (ADR 0024), not an open product question.
Whether PlayerPal ID + password is offered at all was open when this ADR was written; if offered, the table below still constrains it.
Context
A pp_plr_... identifier does not exist before registration, so it cannot be
the first proof of a unique person. Password knowledge also does not establish
uniqueness. Treating password-only signup as a full loyalty account would let
automated accounts redeem, transfer or claim acquisition bonuses.
Decision
Passkey (WebAuthn) is the default bootstrap. Approved social OIDC is supported after a no-PII POC. Partner assertion plus passkey is the preferred embedded flow.
If PlayerPal ID + password is offered, the account is provisional:
| Level | Minimum proof | Economic capabilities |
|---|---|---|
A0_PASSWORD_ONLY | PlayerPal ID + password | Session, add credential, connect partner. No redeem, transfer, or acquisition bonus |
A1_PLAYER_CONTROLLED | Passkey or approved social | Normal access; policy may step up high-value actions |
A2_PARTNER_CONFIRMED | A1 plus valid partner relationship | Earn from that integration; standard redemption per programme |
A3_CORROBORATED | Multiple independent trusted proofs | Higher-value actions where policy permits |
Assurance is not a permanent badge. Revocation, exclusion or partner disconnect can reduce capabilities. Authorization evaluates level, action, programme, jurisdiction, risk and partner scope at execution time.
Player-chosen usernames are not in the initial product.
Consequences
- Upgrade proofs change capabilities without changing
pp_plr_.... - Password reset cannot use email or SMS (ADR 0012).
- See spec §45.8, §46.4 and docs/linking-and-bootstrap.md.