Approving a support session (impersonation)

Approving a support session

Occasionally, Alresford’s support team need to see your Keystone account from the inside to debug a problem you’ve reported. They can’t do this without your approval. The flow is built so you stay in control and there’s a clear audit trail.

What you get

You get an email titled “Approve support access”. The body names:

• Which support agent is asking for access (their Alresford email).
• Which of your accounts they want to access (your email).
• Why — the reason they typed when raising the request.

The email contains a single signed link. Click it to land on the approval page.

The approval page

You see the same three pieces of information, plus an Approve button and a Decline button.

• Approve — grants the support agent 60 minutes of access starting from the moment they activate the session. They will appear in Keystone as you for that period.
• Decline — does nothing destructive. The session is marked refused, and the support agent can re-ask if needed.

During the session

When the support agent activates an approved session, every page in Keystone shows a thick banner that this is a support session and identifies the support agent. You can end the session at any time — there’s a Revoke button in the banner. You can also revoke from the same approval URL.

The session auto-ends after 60 minutes regardless.

What gets logged

Every action the support agent takes while impersonating you is recorded in the audit log with both their identity and yours. There’s no “anonymous” impersonation. You can ask Alresford for the audit slice for any session you approved.

Gotchas

• The approval link is unique to one session. It’s not transferable — if someone else is approving on your behalf, they need a fresh request raised against their account.
• Once approved, you can’t un-approve in advance — only revoke a live session. If you change your mind before the agent activates, contact support directly.
• Sessions can’t be approved retroactively. The agent has to ask, and you have to approve, before they look at your account.