"User A is acting as User B."

Who is the real actor, whose authority is being used, what authority was delegated,
who approved it, for what purpose, for how long, and how is it proven later?

Given any indirect access scenario, you can classify the access mode,
model the actor chain, constrain the authority, enforce policy correctly,
and emit audit evidence that proves who did what under whose authority.

You stop asking "can we impersonate?"
and start asking "which actor chain and authority boundary is this flow allowed to create?"

real actor       = who initiated or controlled the action
effective authority = whose permission set or delegated grant is being used

Normal user action:
real actor = user-123
effective authority = user-123's own membership/permissions

Support impersonation:
real actor = support-42
effective authority = customer-user-123
access mode = USER_IMPERSONATION
reason = ticket-789

Delegation:
real actor = delegate-user-456
effective authority = approval permission delegated by manager-123
constraints = tenant-a, approvals <= $10,000, expires Friday

securityContext.setUser(targetUser);

securityContext.setActorChain(new ActorChain(realActor, effectiveSubject, accessMode, grant));

public record ActorId(String value) {
    public ActorId {
        if (value == null || value.isBlank()) {
            throw new IllegalArgumentException("actor id is required");
        }
    }
}

public enum ActorType {
    HUMAN_USER,
    SUPPORT_USER,
    PLATFORM_ADMIN,
    SERVICE_ACCOUNT,
    EXTERNAL_CLIENT,
    SYSTEM_JOB
}

public enum AccessMode {
    DIRECT,
    CONSENTED_CLIENT_ACCESS,
    DELEGATED_USER_ACCESS,
    SERVICE_ON_BEHALF_OF_USER,
    SUPPORT_ACTING_AS_TENANT,
    USER_IMPERSONATION,
    SUDO_ELEVATION,
    BREAK_GLASS,
    SYSTEM_JOB
}

public record Actor(
        ActorId id,
        ActorType type,
        String displayName,
        String issuer,
        String clientId
) {
}

public record EffectiveSubject(
        ActorId subjectId,
        TenantId tenantId,
        Set<String> roles,
        Set<String> entitlements
) {
}

public record AuthorityGrant(
        String grantId,
        AccessMode mode,
        ActorId grantedBy,
        ActorId grantedTo,
        TenantId tenantId,
        Set<String> allowedActions,
        Set<String> resourceTypes,
        String reasonCode,
        Instant validFrom,
        Instant validUntil,
        boolean active
) {
    public boolean validAt(Instant now) {
        return active && !now.isBefore(validFrom) && now.isBefore(validUntil);
    }
}

public record ActorChain(
        Actor realActor,
        EffectiveSubject effectiveSubject,
        AccessMode accessMode,
        Optional<AuthorityGrant> grant,
        Optional<Actor> originalSubject,
        String correlationId
) {
    public boolean indirect() {
        return accessMode != AccessMode.DIRECT;
    }
}

real actor == effective subject

User reads their own tenant-scoped case.

User allows analytics-client to read case summaries from case-api.

permit = token valid
      AND client allowed
      AND consent active
      AND scope sufficient
      AND audience/resource correct
      AND tenant/resource authorization passes

Manager delegates vacation approval to deputy for tenant-a from Monday to Friday.

case-api calls document-api to fetch attachments for user-123.

Support views tenant configuration for ticket-789.

Support reproduces the exact UI view of user-123.

Platform admin performs MFA step-up before rotating tenant signing key.

Security lead accesses tenant during active incident to stop data exfiltration.

scope = what kind of operation the client may request
domain policy = whether this subject/client may perform this action on this object now

{
  "sub": "user-123",
  "client_id": "analytics-client",
  "aud": "case-api",
  "scope": "case:read",
  "tenant_id": "tenant-a"
}

- client is allowed for tenant-a;
- consent is active;
- user is still active in tenant-a;
- case belongs to tenant-a;
- user can read that case;
- analytics-client is allowed to request that data class;
- purpose and data minimization constraints are met.

A case supervisor can delegate "case.approve" to a deputy for 5 business days.
The deputy can approve only cases in the supervisor's unit.
The deputy cannot delegate the authority further.
Approvals over a severity threshold still require supervisor or director approval.

public record DelegationGrant(
        String id,
        TenantId tenantId,
        ActorId delegator,
        ActorId delegate,
        Set<String> actions,
        Set<String> resourceScopes,
        boolean canSubdelegate,
        Instant startsAt,
        Instant expiresAt,
        String createdBy,
        Instant createdAt,
        boolean revoked
) {
    public boolean activeAt(Instant now) {
        return !revoked && !now.isBefore(startsAt) && now.isBefore(expiresAt);
    }
}

@Transactional
public DelegationGrant createDelegation(CreateDelegationCommand command,
                                         TenantAwarePrincipal principal) {
    decisionService.require(principal, "delegation.create", command.tenantId());

    if (!principal.subject().equals(command.delegator().value())) {
        decisionService.require(principal, "delegation.createForOther", command.tenantId());
    }

    membershipService.requireActiveMember(command.tenantId(), command.delegator());
    membershipService.requireActiveMember(command.tenantId(), command.delegate());

    for (String action : command.actions()) {
        if (!policy.canDelegate(command.delegator(), command.tenantId(), action)) {
            throw new AccessDeniedException("Delegator cannot delegate action: " + action);
        }
    }

    DelegationGrant grant = DelegationGrantFactory.create(command);
    repository.save(grant);

    audit.log(AuditEvent.delegationCreated(grant, principal.subject()));
    return grant;
}

public Decision canUseDelegatedAuthority(ActorChain chain,
                                         String action,
                                         ResourceDescriptor resource,
                                         Instant now) {
    AuthorityGrant grant = chain.grant()
            .orElseThrow(() -> new AccessDeniedException("Delegation grant required"));

    if (!grant.validAt(now)) {
        return Decision.deny("grant_expired_or_inactive");
    }

    if (!grant.allowedActions().contains(action)) {
        return Decision.deny("action_not_in_delegation");
    }

    if (!grant.tenantId().equals(resource.tenantId())) {
        return Decision.deny("tenant_mismatch");
    }

    if (!resource.typeIn(grant.resourceTypes())) {
        return Decision.deny("resource_type_not_in_delegation");
    }

    return Decision.permit("delegation_grant_valid");
}

Frontend obtains token for case-api.
case-api forwards same token to document-api.
document-api accepts token even though audience is case-api.

case-api exchanges incoming user token for a downstream token intended for document-api.

1. Downstream service validates audience for itself.
2. Downstream token is narrower than or equal to upstream authority.
3. Upstream service identity is preserved.
4. Original subject is preserved when needed.
5. Token lifetime is short.
6. Scopes are minimized for downstream call.
7. The downstream service does not accept arbitrary upstream user tokens.
8. Audit can reconstruct user -> client -> upstream service -> downstream service.

public record TokenExchangeRequest(
        String subjectToken,
        String requestedAudience,
        Set<String> requestedScopes,
        String actorClientId,
        String reason
) {
}

grant_type=urn:ietf:params:oauth:grant-type:token-exchange
subject_token=...
subject_token_type=urn:ietf:params:oauth:token-type:access_token
audience=document-api
scope=document:read

Authentication auth = authenticateAs(targetUser);
SecurityContextHolder.getContext().setAuthentication(auth);

ActorChain chain = new ActorChain(
        supportActor,
        effectiveCustomerSubject,
        AccessMode.USER_IMPERSONATION,
        Optional.of(impersonationGrant),
        Optional.of(customerActor),
        correlationId
);

- Support user must be authorized for impersonation.
- Target tenant and target user must be explicit.
- Target user must be active unless incident workflow says otherwise.
- Reason/ticket is required.
- Duration is short.
- Sensitive actions are blocked by default.
- Real actor is shown in audit and admin UI.
- Customer-visible audit is considered.
- Impersonation token/session cannot be used outside intended application/channel.
- Impersonation cannot create long-lived credentials or consents.
- Impersonation cannot approve its own access.

public final class ActorChainAuthentication extends AbstractAuthenticationToken {

    private final ActorChain actorChain;
    private final Jwt jwt;

    public ActorChainAuthentication(Jwt jwt,
                                    ActorChain actorChain,
                                    Collection<? extends GrantedAuthority> authorities) {
        super(authorities);
        this.jwt = jwt;
        this.actorChain = actorChain;
        setAuthenticated(true);
    }

    @Override
    public Object getCredentials() {
        return jwt.getTokenValue();
    }

    @Override
    public Object getPrincipal() {
        return actorChain;
    }

    public ActorChain actorChain() {
        return actorChain;
    }
}

final class ActorChainJwtAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken> {

    @Override
    public AbstractAuthenticationToken convert(Jwt jwt) {
        Actor realActor = extractRealActor(jwt);
        EffectiveSubject effectiveSubject = extractEffectiveSubject(jwt);
        AccessMode mode = extractAccessMode(jwt);
        Optional<AuthorityGrant> grant = extractGrant(jwt);
        Optional<Actor> originalSubject = extractOriginalSubject(jwt);

        ActorChain chain = new ActorChain(
                realActor,
                effectiveSubject,
                mode,
                grant,
                originalSubject,
                correlationId()
        );

        Collection<GrantedAuthority> authorities = mapTechnicalAuthorities(jwt, chain);
        return new ActorChainAuthentication(jwt, chain, authorities);
    }
}

public record AuthorizationRequest(
        ActorChain actorChain,
        String action,
        ResourceDescriptor resource,
        Map<String, Object> context
) {
}

public Decision decide(AuthorizationRequest request) {
    ActorChain chain = request.actorChain();

    if (!chain.effectiveSubject().tenantId().equals(request.resource().tenantId())) {
        return Decision.deny("tenant_mismatch");
    }

    if (chain.accessMode() == AccessMode.USER_IMPERSONATION
            && sensitiveActions.contains(request.action())) {
        return Decision.deny("impersonation_sensitive_action_blocked");
    }

    if (chain.accessMode() == AccessMode.DELEGATED_USER_ACCESS) {
        Decision delegation = canUseDelegatedAuthority(
                chain,
                request.action(),
                request.resource(),
                clock.instant()
        );
        if (!delegation.permitted()) {
            return delegation;
        }
    }

    return domainPolicy.decide(request);
}

@PreAuthorize("@casePolicy.canApprove(authentication.principal, #tenantId, #caseId)")
public void approveCase(TenantId tenantId, UUID caseId) {
    // domain mutation
}

@Component
public class CasePolicy {

    public boolean canApprove(Object principal, TenantId tenantId, UUID caseId) {
        ActorChain chain = (ActorChain) principal;

        if (chain.accessMode() == AccessMode.USER_IMPERSONATION) {
            return false;
        }

        if (chain.accessMode() == AccessMode.DELEGATED_USER_ACCESS) {
            return delegationPolicy.allows(chain, "case.approve", tenantId, caseId);
        }

        return membershipPolicy.hasEntitlement(chain.effectiveSubject(), tenantId, "case.approve");
    }
}

Who initiated the action?
Under whose authority?
Through which client/service?
In which tenant?
For which reason/grant?
What was requested?
What was decided?
What policy allowed/denied it?

public record AccessAuditEvent(
        String eventId,
        Instant occurredAt,
        TenantId tenantId,
        String action,
        String resourceType,
        String resourceId,
        String decision,
        String reasonCode,
        AccessMode accessMode,
        Actor realActor,
        EffectiveSubject effectiveSubject,
        Optional<AuthorityGrant> grant,
        Optional<Actor> originalSubject,
        String clientId,
        String sessionId,
        String correlationId,
        String policyId,
        String denialReason
) {
}

{
  "tenantId": "tenant-a",
  "action": "case.read",
  "resourceType": "case",
  "resourceId": "case-999",
  "decision": "PERMIT",
  "accessMode": "USER_IMPERSONATION",
  "realActor": {
    "id": "support-42",
    "type": "SUPPORT_USER"
  },
  "effectiveSubject": {
    "subjectId": "user-123",
    "tenantId": "tenant-a"
  },
  "reasonCode": "ticket-789",
  "policyId": "case-read-v3",
  "correlationId": "corr-abc"
}

{
  "user": "user-123",
  "action": "case.read"
}

public record ConsentGrant(
        String consentId,
        TenantId tenantId,
        ActorId resourceOwner,
        String clientId,
        Set<String> scopes,
        Set<String> audiences,
        Set<String> resourceTypes,
        Instant grantedAt,
        Instant expiresAt,
        boolean revoked,
        String policyVersion
) {
    public boolean activeAt(Instant now) {
        return !revoked && now.isBefore(expiresAt);
    }
}

public Decision checkConsent(ConsentGrant consent,
                             String clientId,
                             String audience,
                             String scope,
                             TenantId tenantId,
                             Instant now) {
    if (!consent.activeAt(now)) return Decision.deny("consent_inactive");
    if (!consent.clientId().equals(clientId)) return Decision.deny("client_mismatch");
    if (!consent.tenantId().equals(tenantId)) return Decision.deny("tenant_mismatch");
    if (!consent.audiences().contains(audience)) return Decision.deny("audience_not_consented");
    if (!consent.scopes().contains(scope)) return Decision.deny("scope_not_consented");
    return Decision.permit("consent_valid");
}

- actor is in emergency access group;
- actor passes step-up authentication;
- actor enters reason and incident id;
- optional second approver approves;
- access expires automatically;
- access is narrow to tenant/action/resource class;
- notifications are sent to security/compliance;
- post-access review is required;
- audit is immutable/tamper-evident enough for your risk model.

public record BreakGlassGrant(
        String id,
        ActorId actor,
        TenantId tenantId,
        Set<String> allowedActions,
        String incidentId,
        String justification,
        Optional<ActorId> approvedBy,
        Instant issuedAt,
        Instant expiresAt,
        boolean closed,
        Optional<String> reviewOutcome
) {
}

public Decision decideBreakGlass(ActorChain chain, AuthorizationRequest request) {
    AuthorityGrant grant = chain.grant()
            .orElse(null);

    if (grant == null) {
        return Decision.deny("break_glass_grant_required");
    }

    if (!grant.validAt(clock.instant())) {
        return Decision.deny("break_glass_expired");
    }

    if (!grant.tenantId().equals(request.resource().tenantId())) {
        return Decision.deny("break_glass_tenant_mismatch");
    }

    if (!grant.allowedActions().contains(request.action())) {
        return Decision.deny("break_glass_action_not_allowed");
    }

    audit.highSeverity(AuditEvent.breakGlassUsed(chain, request));
    return Decision.permit("break_glass_valid");
}

You are impersonating Jane Doe in Tenant A.
Reason: ticket-789.
Session expires in 08:31.
Sensitive actions are disabled.
End impersonation.

X-Access-Mode: USER_IMPERSONATION
X-Effective-Subject: user-123

Support user support-42 viewed case-999 under ticket-789 at 2026-06-28T12:00:00Z.

SecurityContextHolder.getContext().setAuthentication(targetUserAuth);

@Test
void impersonationAuditPreservesRealActor() {
    Actor support = actor("support-42", ActorType.SUPPORT_USER);
    EffectiveSubject customer = effectiveSubject("user-123", "tenant-a");
    AuthorityGrant grant = grant("ticket-789", AccessMode.USER_IMPERSONATION);

    ActorChain chain = new ActorChain(
            support,
            customer,
            AccessMode.USER_IMPERSONATION,
            Optional.of(grant),
            Optional.of(actor("user-123", ActorType.HUMAN_USER)),
            "corr-1"
    );

    service.readCase(chain, new TenantId("tenant-a"), caseId);

    AccessAuditEvent event = audit.lastEvent();
    assertThat(event.realActor().id().value()).isEqualTo("support-42");
    assertThat(event.effectiveSubject().subjectId().value()).isEqualTo("user-123");
    assertThat(event.accessMode()).isEqualTo(AccessMode.USER_IMPERSONATION);
}

@Test
void impersonationCannotResetMfa() {
    ActorChain chain = fixtures.impersonationChain("support-42", "user-123", "tenant-a");

    assertThatThrownBy(() -> accountService.resetMfa(chain, new TenantId("tenant-a"), "user-123"))
            .isInstanceOf(AccessDeniedException.class);
}

@Test
void cannotDelegateActionDelegatorDoesNotHave() {
    CreateDelegationCommand command = new CreateDelegationCommand(
            new TenantId("tenant-a"),
            new ActorId("manager-1"),
            new ActorId("delegate-1"),
            Set.of("case.delete"),
            expiresTomorrow()
    );

    when(policy.canDelegate(new ActorId("manager-1"), new TenantId("tenant-a"), "case.delete"))
            .thenReturn(false);

    assertThatThrownBy(() -> delegationService.createDelegation(command, managerPrincipal()))
            .isInstanceOf(AccessDeniedException.class);
}

@Test
void revokedConsentDeniesClientAccess() {
    ConsentGrant consent = fixtures.revokedConsent("user-123", "analytics-client", "tenant-a");

    Decision decision = consentPolicy.checkConsent(
            consent,
            "analytics-client",
            "case-api",
            "case:read",
            new TenantId("tenant-a"),
            Instant.now()
    );

    assertThat(decision.permitted()).isFalse();
    assertThat(decision.reason()).isEqualTo("consent_inactive");
}

@Test
void downstreamRejectsTokenForWrongAudience() throws Exception {
    Jwt tokenForCaseApi = jwt("user-123", "case-api", "tenant-a", List.of("document:read"));

    mvc.perform(get("/documents/{id}", documentId)
                    .with(jwt().jwt(tokenForCaseApi)))
            .andExpect(status().isUnauthorized());
}

@Test
void expiredBreakGlassGrantDenied() {
    ActorChain chain = fixtures.breakGlassChainExpired("security-1", "tenant-a");

    Decision decision = policy.decide(new AuthorizationRequest(
            chain,
            "case.readSensitive",
            resource("case", caseId, "tenant-a"),
            Map.of("incidentId", "inc-1")
    ));

    assertThat(decision.permitted()).isFalse();
    assertThat(decision.reason()).isEqualTo("break_glass_expired");
}

- impersonation started;
- impersonation sensitive-action denial;
- break-glass used;
- delegation created for high-risk action;
- delegation used near expiry;
- consent granted to sensitive client;
- token exchange denied due to audience/client mismatch;
- support access without ticket;
- repeated impersonation of same target;
- cross-tenant delegation attempt.

1. Who was the real actor?
2. What was the access mode?
3. Who was the effective subject?
4. What tenant was targeted?
5. Which grant/consent/ticket/incident authorized it?
6. Was the grant active at the time?
7. Was the action within allowed scope?
8. Was the resource within allowed tenant/resource boundary?
9. Was any sensitive action blocked or allowed?
10. Who reviewed the event afterward?

A regulatory enforcement platform supports multiple agencies.
A case supervisor can delegate approval rights while on leave.
A support engineer may view a tenant's case screen only after a customer ticket is approved.
A document service is called by case-api to fetch attachments on behalf of the current user.
Security leads can use break-glass during active incidents.
Customer agencies require audit evidence for all support access.