Support access
How FurniOps support can see what one of your members sees, the limits on it, how every access is recorded in your audit log, and how an organisation blocks it.
When you ask FurniOps support for help, a support engineer may need to see what you see. FurniOps never uses shared passwords or a "log in as" backdoor for this. Instead, a support engineer opens support access: a short-lived, audited token that acts as one of your members, within that member's permissions, and carries both identities.
The limits
| Limit | Rule |
|---|---|
| Who | Only FurniOps staff with a support role, signed in with two-step verification, recently. Staff never act for themselves or for other staff. |
| For whom | One member of your organisation, in your organisation only. |
| Why | A written reason is required for every access (8 to 500 characters), and a support ticket may be named. |
| What | What that member can see. Reads by default; write access only for staff holding the senior support role, and never beyond the member's own permissions. |
| How long | 5 minutes, with no refresh. Continuing means a new access, checked and recorded again. |
Every check runs at every access, so if your organisation blocks support access, the member's role changes, or they leave, access ends within 5 minutes at most.
Every access is in your audit log
Each access is written to your organisation's audit log as Support
access granted (support_access.granted), in the same step that allowed it: an access is in your
log exactly when it happened. The entry names the staff member, the member they acted for, the
reason and ticket, the mode, the permissions, and when the access expires.
Everything support then does appears in the audit log and the request logs as the staff member (actor FurniOps staff), with the member they acted for.
Blocking support access
Support access is allowed by default. An organisation's owner can block it under
Settings › Security › Organisation policies (the organisation's support_access setting:
allowed or blocked); FurniOps support then cannot open access to the organisation at all, and
the engineer is told the organisation does not allow it. Changing it needs a sign-in from the last
10 minutes; see Organisation policies.
Account security
Passkeys, two-step verification with an authenticator app, recovery codes, passwords, sessions, connected apps, and when FurniOps asks you to confirm it is you.
Audit log
The organisation's one timeline of who did what, from sign-in policy to API keys and data operations. What is recorded, what an entry holds, filtering it in the dashboard and the API, and how long it is kept.