Agent WranglersSupport and staff access Required
Use separate staff accounts
Give staff accounts that are separate from customer accounts, signed in through company single sign-on with a passkey or security key.
How to do it
The factor rule lives in two-factor login. Keep staff in their own table or identity provider, with their own roles. Run the admin tool on its own host, such as admin.example.com, reachable only from company devices or a private network. Give each person only the tools their job needs. Remove access on someone's last day, through the company directory. Log what staff read, as log who reads personal data says.
How to check
Sign in to the admin host with a customer account, and it is refused. Compare the staff accounts with the company directory. Nobody who has left still has one.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/support-and-staff-access/staff-accounts.