Platform Admin support login

Platform Admin can open a support session as a tenant’s existing undeleteable owner (TENANT_OWNER). No new admin user is created and the owner’s password is not used.

Start a session

1. Sign in as Platform Admin.
2. Open Platform Admin → Tenants.
3. Choose Login as tenant admin.
4. Enter a reason (required, at least 8 characters).
5. Confirm. You land in that tenant with a red banner.

Rules:

• Your Platform Admin session must be fresh (token issued within the last 15 minutes); otherwise re-authenticate first.
• Support session lasts at most 60 minutes.
• Nested support / login-as is blocked.
• Password change is blocked during the session.

Banner and exit

Every page shows a red banner: Support session as <tenant>. Use Exit support session to return to Platform Admin. Exit is audited.

Audit

Each start and end is written to:

• The tenant audit log (so the tenant can see support activity)
• The Platform Admin audit trail (SUPPORT_LOGIN_START / SUPPORT_LOGIN_END)

Owner approval before support access is not required in this version; full tenant-visible audit is mandatory. An optional approval toggle can follow later.