# ADR 0020. Assurance Levels A0-A3; Password-Only Is Provisional

## Status
Accepted.

**Amendment (ADR 0022 / 0024):** PlayerPal ID + password **is offered** on the
player portal (provisional A0). Create and sign-in are Nest-owned
([ADR 0024](0024-nest-owned-portal-auth.md)), not an open product question.

Whether PlayerPal ID + password is offered at all was open when this ADR was
written; **if** offered, the table below still constrains it.

## Context
A `pp_plr_...` identifier does not exist before registration, so it cannot be
the first proof of a unique person. Password knowledge also does not establish
uniqueness. Treating password-only signup as a full loyalty account would let
automated accounts redeem, transfer or claim acquisition bonuses.

## Decision
Passkey (WebAuthn) is the default bootstrap. Approved social OIDC is supported
after a no-PII POC. Partner assertion plus passkey is the preferred embedded
flow.

If PlayerPal ID + password is offered, the account is **provisional**:

| Level | Minimum proof | Economic capabilities |
|---|---|---|
| `A0_PASSWORD_ONLY` | PlayerPal ID + password | Session, add credential, connect partner. No redeem, transfer, or acquisition bonus |
| `A1_PLAYER_CONTROLLED` | Passkey or approved social | Normal access; policy may step up high-value actions |
| `A2_PARTNER_CONFIRMED` | A1 plus valid partner relationship | Earn from that integration; standard redemption per programme |
| `A3_CORROBORATED` | Multiple independent trusted proofs | Higher-value actions where policy permits |

Assurance is not a permanent badge. Revocation, exclusion or partner
disconnect can reduce capabilities. Authorization evaluates level, action,
programme, jurisdiction, risk and partner scope at execution time.

Player-chosen usernames are not in the initial product.

## Consequences
- Upgrade proofs change capabilities without changing `pp_plr_...`.
- Password reset cannot use email or SMS (ADR 0012).
- See spec §45.8, §46.4 and [docs/linking-and-bootstrap.md](../linking-and-bootstrap.md).