Impersonation — logging in as another user

Who can impersonate

v1: super admin only. Admin-in-own-org impersonation (manager/staff) coming in v1.1.

How it works

1. Go to /admin/users (or /admin/organizations/[id])
2. Find the user you want to impersonate
3. Click Log in as
4. Optional prompt: enter a reason (ticket ID, "debugging X")
5. You're redirected to /dashboard — now viewing as them

An amber banner sticks to the top of every page:

Viewing as {name} ({role} @ {org}) · Expires in {countdown} · [Extend 30 min] [Return to your account]

What you can see

Everything the target user sees. All their modules, their org data, their dashboards.

What's blocked

While impersonating, the following actions return 403:

• Password change (you can't reset their password)
• Account delete (you can't delete the target or their org)
• Billing mutations
• 2FA enroll/disable
• Email/phone change on their profile
• Starting another impersonation (no nesting)

This means you can't lock someone out of their own account by impersonating them.

Time limits

• Default: 30 minutes. After that, session auto-expires and you're returned to your super admin identity.
• Extend once — one time per session, add 30 more minutes. After that, you have to start a fresh session.
• Return to your account — exit early any time.

Audit trail

Every impersonation writes synthetic events to AuditLog:

• impersonation_started — when it begins
• impersonation_extended — when extended
• impersonation_ended — when exited (reason: actor_exit / expired / admin_force / target_password_changed)

The target's password-change endpoint automatically revokes all active impersonations targeting them — so if someone resets their password while you're impersonating, you get kicked out immediately.

Known limitation (v1): mutations during impersonation don't currently tag actorId on their AuditLog rows (audit logs show the target as the actor). Full actor-tagging coming in v1.1. Use the impersonation session ID to correlate for now.

Security admin

/admin/impersonation shows all active impersonation sessions across the platform:

• Actor → Target
• Started at / expires at
• Extended (yes/no)
• Revoke all button (incident response — kills every active session)

Rate limits

• Max 10 impersonation starts per super admin per hour
• Max 3 concurrent non-revoked sessions per super admin

If you hit either, wait or revoke-all your own existing sessions.

When to use it

• A user reports "X doesn't work" — log in as them, reproduce, fix
• Onboarding a new org — walk through their setup with them
• Debugging a permission issue that doesn't repro with your super admin role

When NOT to use it

• Routine account access — create a proper staff account instead
• Making changes on the user's behalf — tell them what to click; don't do it for them
• Anything you wouldn't want them to know about — the AuditLog captures every start

Rollback

Exit via the banner's Return to your account button. Or close the tab and re-open from your super admin dashboard — the session expires naturally.