2

I'm updating a product that previously had a single checkbox to allow our support team to login to the user's account. Once in, the support rep had full admin level permissions.

The product deals with very sensitive financial information for institutional investors, so I'm leaning towards something very defined, but am trying to balance this with the need of my support team to be able to do their jobs.

I'm wondering if there's any standard that says that this should be done by defining a window of time that the support rep can access this account? Or maybe allow the user to define the support rep's permissions?

  • 1
    This sounds more like a security issue than usability. However I have certainly come across this. If you're a small organisation fulfilling orders for a large organisation (say a University), then their finance department will sometimes refuse to go through your e-commerce system. So then you need to do it on the customers behalf. – icc97 Apr 11 '16 at 15:58
  • 1
    GoDaddy uses a PIN number - you can enter it in your account. When I call support I have to give my PIN number (proving that I can access that account) before the support rep can access my data - ie the support system used by the reps uses the pin as its means of authorization to access my data. – Marjan Venema Apr 14 '16 at 7:23
1

Your industry or company may define any regulatory or other requirements you must be able to support, such as requiring a user's permission before you can log in as them. But speaking from a technical perspective, having built several systems like this before, here are some features that I have found helpful:

  • Ability to log in as a customer is a controlled permission that only admins or certain support reps have access to
  • Rep should have ability to search for user to log in as, filtering by company/location/account type/etc
  • System should audit which rep logs in as which customer at which time
  • When logged in as customer, rep should see exactly that that user would see (and not get an "admin" view where you can see everything), to better troubleshoot user's experience

Having a feature like this is often extremely useful so support reps can see what the client is seeing. But it's true the system must be built with care.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.