Seeing an account as its owner

What this is for

Support cannot diagnose what it cannot see. When somebody says their dashboard is wrong, the reliable answer is to look at the dashboard they are looking at - their plan, their domains, their check history, their empty states. Describing a screen to each other over email is a game of telephone, and the thing that is actually wrong is usually the thing neither of you thought to mention.

So this opens their panel as them. It is a genuinely useful support capability and it is also the most dangerous thing in the product, because it is by construction a sanctioned way for one person to become another person. Everything below exists because of that.

When it is appropriate

They asked

Somebody has reported a problem with a screen and you cannot reproduce it from the console. This is the case it was built for.

You have exhausted the console

Accounts, Organisations and the audit trail answer most questions and answer them without entering anything. Try them first - not as a formality, but because they are faster.

You can say why in one line

If you cannot, that is the signal. The reason is stored with the session and read by whoever asks, months later, why anybody was in there.

What the customer sees

They are told. Every organisation they hold a seat in gets a row in its own Account activity screen saying that MailGuardHQ support opened the account, when, and when the session was due to close. A second row lands when it closes.

It is immediate, not delayed. There is no window in which you are in there and they cannot find out.

They are told it was MailGuardHQ, not which of us. Your individual name is on the staff record rather than on theirs, and the reference on their row resolves to exactly one event - so if they ask who and why, we can answer, without publishing your name into every account you have ever helped.

The reason you typed is not shown to them. It is a support note and may name a ticket, a colleague or another customer. Write it for us.

What you cannot do while you are in there

Nothing that writes. Every request that is not a read is refused, by middleware rather than by each screen, so a route nobody has written yet is already covered. There is no list of blocked actions to keep up to date, which is the point - a list would go stale the first time somebody added an endpoint.

You cannot obtain their credentials. No password, no password reset, and no existing token value. A token's value does not exist anywhere to be read back, and minting a new one is a write, so it is refused.

You cannot reach the console. A borrowed session is not a platform administrator, so every console route answers it the way it answers a customer: as though the path does not exist. You cannot start a second session from inside one either.

You cannot enter another administrator's account. Admin-on-admin is a privilege-escalation path and is refused with a reason.

Starting, and leaving

Your password, again

A signed-in session is not enough - a browser somebody walked away from would be. You are asked to re-confirm before the reason field appears.

A written reason

Refused rather than truncated if it is too long. One line: the ticket, the symptom, or their own request.

The banner

While you are in there, every screen carries a banner naming the customer and the time left. It cannot be dismissed, because the confusion it prevents - forgetting which capacity you are acting in - is exactly the confusion that turns a support action into a customer action.

Leave this account

The button in that banner. It ends the session at once and writes the closing row. Your own session is untouched - you were never signed out of it.

It also ends by itself. A session left open is an unattended door, so it expires on a time box whether or not you remember. Leaving deliberately is still better: it puts the end on the customer's record at the moment you actually stopped looking, rather than at the moment the clock ran out.

What is recorded

Your name, their account, the time, the reason, and a reference - at the start and again at the end. Every action taken during the session carries both names: you as the person who acted, them as the account it happened in. One field cannot carry both, and a trail that recorded only the customer would assert something false rather than merely omit something true.

An unusual number of starts by one person in an hour raises an alert. The abuse case here is an insider one, so the signal is volume by one staff member rather than volume across the platform. It alerts and allows: being told is what is wanted, being stopped in the middle of an incident is not.