Conversation

Notices

1. Embed this notice
   Simon Willison (simon@fedi.simonwillison.net)'s status on Saturday, 27-Apr-2024 05:56:08 JST Simon Willison

   I'm considering building a feature for a SaaS app that lets you "invite" a customer support person to be able to see your private data in order to help you debug an issue - where everything they look at is logged in an audit log that's visible to you and you also get to see when they "resign" from their temporary access

   Is this a common feature? Has anyone seen good implementations of this kind of pattern before?

   • Embed this notice
     Eaton (eaton@phire.place)'s status on Saturday, 27-Apr-2024 05:56:07 JST Eaton

     in reply to

     @simon we had to work through some of the complexities around that a number of years ago, for a client developing a highly personalized HR portal. Call center staff supporting the site needed to have some way of duplicating the precise mix of “stuff” a given user was seeing, without gaining unecessary access to deeply personal (sometimes dangerously so) information.

   • Embed this notice
     Eaton (eaton@phire.place)'s status on Saturday, 27-Apr-2024 05:59:22 JST Eaton

     in reply to

     @simon for them, expiring hashes to represent one particular user’s view of one particular page could be given to a call center rep, without the risk of them clicking around to other areas, etc.