Impersonation

Impersonation lets an authorized user temporarily operate the dashboard as another user — seeing exactly what they see. It's the fastest way to reproduce a reported issue, verify permissions, or walk a new member through a setup.

Your kuploy-cloud instance uses a tiered model so that platform operators, organization owners, and trusted org admins each get only the scope they need.

The four tiers

Tier	Who	May impersonate	Admin UI access
Platform owner	You — the person(s) running this kuploy-cloud instance	Anyone, in any organization	Full /admin access
Platform operator	A trusted staff member you promote for support duties	Anyone, in any organization	No /admin access — impersonation only
Organization owner	The creator / owner of an organization	Any user inside their own organization	No
Delegated org admin	An organization admin the org owner has explicitly trusted	Non-admin users inside their own organization	No

Cross-organization impersonation is limited to the platform tiers. An org owner can never reach users in a different organization, and a delegated admin can never reach the org owner or other admins — these are enforced server-side, not just hidden in the UI.

Managing platform admins

Go to /admin → Platform Admins in your dashboard.

Owner vs Operator

When adding or editing a platform admin you pick a role:

• Owner — full administrative access. Can configure Stripe, SMTP, branding, domains, plan limits; can add, remove, and change other platform admins. Reserve this for people who operate the platform itself.
• Operator — impersonation-only. Can impersonate any user on the platform for support purposes but cannot change platform configuration or modify the admin list. Use this for support staff who help customers without needing full infrastructure access.

You cannot demote or remove the last remaining owner — there's always at least one.

Adding an admin

The Add Platform Admin form accepts either:

• A free-text email for a user you want to promote fresh, or
• A Pick from org admins picker that lists existing organization owners and admins across your instance — handy for promoting someone your customers already trust operationally to the Operator role, without retyping their email.

Delegating inside an organization

Organization owners can delegate impersonation to a trusted org admin without handing over ownership. This is useful when you have a senior team member who handles support tickets for the org.

1. The org owner opens Settings → Users inside their organization.
2. They find an admin-role member.
3. They toggle Can Impersonate to on.

The toggle is visible only to the org owner and only on members whose role is Admin. If a delegated admin is later demoted to a regular member, the delegation is revoked automatically.

Using impersonation

1. Click the gear icon at the bottom-right of any dashboard page.
2. In the floating bar, pick a user from the dropdown — the list is scoped to what your tier allows.
3. Click Impersonate. The page reloads and you are now acting as the selected user.
4. When finished, click Stop Impersonating to return to your own session.

If you don't see the gear icon at all, your tier doesn't grant impersonation. Ask your platform owner or organization owner.

What gets logged

Every impersonated session is tagged with the real actor's identity, and stopping impersonation is recorded too. That means:

• Actions performed during impersonation are attributable — the audit trail shows the real user, not just the impersonated account.
• If something goes wrong while impersonating, you can always trace who performed the action.

FAQ

Can a regular team member impersonate someone?
No. Impersonation is limited to organization owners and delegated org admins inside an organization, and to platform owners or operators at the platform level.

Can my delegated admin impersonate another admin?
No. Delegates are deliberately restricted to non-admin members — this prevents one trusted delegate from bootstrapping access to the whole organization.

I enabled Can Impersonate but the admin still doesn't see the bar.
Ask them to hard-refresh the dashboard. The impersonation bar is gated by a permission check that loads once per page.

An operator I promoted can still see the /admin dashboard.
Have them sign out and back in so their session picks up the new role. If the issue persists, open a support ticket — the operator role should strictly deny access to platform-configuration pages.