Impersonate

A workspace session for the operator, seeing exactly what the customer sees.

Support has been reconstructing customer screens from raw tables: "queued looks low" arrives as a screenshot, and answering it meant six SQL queries to rebuild a dashboard the product already renders. The app adopts a ?token= once and wipes it from the URL, so the cheapest honest view is the customer's own: mint the same capability token their login mints, open their workspace with it.

The mint is written to the audit trail. The kind is not in the customer's activity whitelist, so the operator's visit does not appear in their feed - but it is in the database, attributable, with the admin's identity on it.