Design a safe 'login as user' (admin impersonation) feature for a customer-support team.

Issue a distinctly-scoped, short-lived impersonation token containing both the support agent's own identity AND the target user's identity (e.g., acting_as / on_behalf_of claims), rather than simply re-authenticating as the target user. Restrict impersonation tokens from performing destructive/sensitive operations (e.g., changing the user's password or email), require the action to be explicitly re-authorized per session, and audit-log every impersonated action against BOTH identities for accountability.