### Problem/Motivation The module answers "who is this visitor?" and hands the answer to block conditions, Twig, tokens, JavaScript and a global Views filter. The mirror question, "who is this content for?", has nowhere to live. A site that wants to hide an entity from visitors outside a segment has to invent a `list_string` field, an access hook, a Search API processor and a per-row Views filter, and site-by-site implementations tend to forget half of the leaks (entity queries, feeds, exports, views on a base table). ### Proposed resolution A new submodule, `mautic_audiences_field`, so the base module keeps being "read audiences, expose primitives" and nobody loads an access hook they did not ask for. 1. **Field type `mautic_audience`.** Stores segment aliases (storage setting `kind: segments|tags`), unlimited cardinality. The module ships the type; each site adds the field to the bundles it wants. No allowed-values constraint: an alias Mautic renamed must still save. 2. **Widget.** Check boxes fed by `SegmentList`. A stored alias that no longer exists in Mautic stays checked and is labeled as missing, instead of disappearing from the form and being dropped on the next save. An unreachable Mautic is reported as such rather than as deleted segments, and a refresh button drops the hourly cache. 3. **Field access.** `hook_entity_field_access()` denies `view` on the field to anyone without the administer permission. That keeps the alias inventory out of formatters, JSON:API, REST and Views field handlers by construction, in line with `docs/security.md` ("check, don't list"). Templates ask a yes/no question instead. 4. **Twig.** `is_in_segment()` and `has_tag()` accept a `FieldItemListInterface`, and every variant bubbles the narrow `mautic_audience.segment:<alias>` / `mautic_audience.tag:<value>` cache contexts through the renderer, the way `MetadataBubblingUrlGenerator` does for URLs. Today a template that branches on these functions caches the first visitor's answer for everyone unless the theme declares the context by hand. 5. **Per-row Views filter**, registered through `hook_field_views_data_views_data_alter()` for the SQL query plugin: two `EXISTS` subqueries, so a row matching two of the visitor's aliases never comes back twice. A checkbox decides whether rows with no audience stay in the listing. 6. **Search API processor** at query time, in the shape of core's `ContentAccess`: indexes the field plus a marker for items no enforcing field targets, adds the condition in `preprocessSearchQuery()`, honors `search_api_bypass_access` and `search_api_access_account`, and adds the `mautic_audience` cache context to the query. Gated items stay in one index and only surface for visitors they are for, so facets and search work inside a gated area without a second index. 7. **Opt-in enforcement.** A field instance setting, "Enforce as view access", off by default, that turns on a `hook_entity_access()` for `view`. It answers forbidden or neutral and never allowed, because core combines hook results with `orIf()` and an allowed here would override the entity's own handler and open an unpublished entity to a matching visitor. The entity type's administrators are never gated. 8. **Documentation of the leaks enforcement does not cover**: entity queries, `loadMultiple()` in custom code, feeds, exports, views on a base table without the filter from point 5, and an order item created before the customer left the segment. Node grants (realm `mautic_audience`, one record per segment) are a follow-up for nodes only, in a separate issue. ### Decisions - Aliases, not numeric segment IDs. The resolver, conditions and Twig already work with aliases; a rename is handled in the widget and documented. - Enforcement is opt-in per field. On by default would make this an access module, with the coverage and expectations that implies. - Anonymous visitors count: a visitor with an `mtc_id` cookie in the right segment passes without logging in, which is what lets a campaign link open a gated entity. Sites that want authentication combine it with the entity's own permissions. ### Remaining tasks One commit per block in a single merge request, each with kernel tests, plus browser coverage of the editor's form and of the gate as an anonymous visitor meets it.