I'm updating a product that previously had a single checkbox to allow our support team to login to the user's account. Once in, the support rep had full admin level permissions.
The product deals with very sensitive financial information for institutional investors, so I'm leaning towards something very defined, but am trying to balance this with the need of my support team to be able to do their jobs.
I'm wondering if there's any standard that says that this should be done by defining a window of time that the support rep can access this account? Or maybe allow the user to define the support rep's permissions?