---
title: "Use separate staff accounts · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/support-and-staff-access/staff-accounts
updated: 2026-10-20
licence: "All rights reserved"
---

# Use separate staff accounts

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Support and staff access](https://agentwranglers.se/playbook/accounts/support-and-staff-access)
- Rule: Give staff accounts that are separate from customer accounts, signed in through company single sign-on with a passkey or security key.
- How: The factor rule lives in [two-factor login](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/two-factor-login). Keep staff in their own table or identity provider, with their own roles. Run the admin tool on its own host, such as `admin.example.com`, reachable only from company devices or a private network. Give each person only the tools their job needs. Remove access on someone's last day, through the company directory. Log what staff read, as [log who reads personal data](https://agentwranglers.se/playbook/data/personal-data/access-logging) says.
- Check: Sign in to the admin host with a customer account, and it is refused. Compare the staff accounts with the company directory. Nobody who has left still has one.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/support-and-staff-access/staff-accounts`.

- Next: [Check who is asking before support changes an account](https://agentwranglers.se/playbook/accounts/support-and-staff-access/support-identity-check)
- [Support and staff access](https://agentwranglers.se/playbook/accounts/support-and-staff-access)