Skip to main content
InternalMarkdown

ADR 0031. Group Connected partners; confirm names the cascade

Status​

Accepted (as listed in the decisions index).

ADR 0030 keeps Unlink on the PlayerPal Account, one Audience per Unlink target, operator-led Unlink cascading provider-operator integrations for that operator, and provider-led Unlink as that integration only. The Account list was a flat row per connection. Unlink of the operator Party then looked like “one item, everything gone,” because confirm named the cascade in a sentence and not the Audiences.

GET /v1/me also omitted which operator Party a provider-operator integration belongs to, so the portal could not list cascade members without guessing labels or treating every Provider row as in-scope.

Decision​

Connected partners groups provider-operator integrations under the operator Party they are scoped to. Each Unlink target remains one Audience. Nesting is chrome, not a new Audience kind.

Unlink controls:

  • Operator parent — Unlink of that operator Party. Confirm names every Audience that will drop (the operator Party and each nested provider-operator integration). Cascade is unchanged.
  • Nested provider row — Unlink of that provider-operator integration only. The operator parent stays, including when it has no children left.
  • Top-level Provider row — a provider-led integration with no operator Party connection on this Account. No synthetic operator parent. Unlink is that integration only.

GET /v1/me connections that are provider_operator include operator_audience_id: the operator Party public id (pp_opr_...), the same value as that operator row’s audience_id. PlayerPal sets it from authenticated integration configuration (operator_party_id), never from a partner payload. It is not a private UUID and not pp_plr_....

Do not guess the cascade set from labels. Do not send operator_id on Unlink; the path param is the Audience being Unlinked.

Consequences​

  • Operator Unlink confirm can list the real cascade set from /v1/me.
  • Provider-led-only integrations stay Unlinkable without inventing an operator Audience.
  • ADR 0030 is not rewritten. Widget Unlink remains a later slice.
  • Identity invariants 2, 8, and 12 still hold: no private player UUID to a partner, no operator scope from an untrusted provider payload, no player PII in the new field.