View As Start

Frederick, 2026-08-09: "log in as myself, but then view the app as a different user, so I can see exactly what they see" -- confirming each person's desk actually works for them before staff log in Monday morning, especially now that ticket visibility just moved to role-based grants (migrations/0137).

READ-ONLY (app/platform/auth.current_principal's own chokepoint refuses every write but this route's own exit, by HTTP method -- see its docstring for why per-route enumeration was rejected), STAGING ONLY (checked here at mint time, and again on every subsequent request -- a forged or replayed token must fail on the server, not merely be hidden in the UI), and AUDITED (view_as_events, migrations/0139, written BEFORE the token is minted, not after, so a session that somehow never gets used is still on record as having been granted).

Naturally unreachable while ALREADY viewing as someone: this route is itself a POST, and current_principal's read-only gate refuses every POST except VIEW_AS_EXIT_PATH -- switching identities requires exiting first, so a view-as session is always exactly one identity, never nested.

404s (not a silent no-op) on an unknown, non-human, or offboarded target -- the picker (supervisor_service.list_assignable_colleagues) only ever offers a real active human, but this is the server's own floor, never merely trusted from the request body.