A record written from the choke point where the acting account is resolved, not from the buttons that lead there. It captures the actor's identity, their platform role, the account entered and the route in — open-as, subdomain or session — and is throttled to one row per account per visit rather than one per page view.
Also called: who accessed my account · vendor access log · impersonation log · audit of support visits
- 1The row is written after the acting account is resolved, because 'entered a tenant' is meaningless without saying which one.
- 2Recording is throttled with a thirty-minute window keyed on actor and account.
- 3The throttle key deliberately excludes the path, because entering an account is a fact about the account, not the route that resolved it.
- 4The dedicated impersonate endpoint additionally records the stated reason before returning the URL to open.
- 5Owner entries are recorded too.
The rule is written into the code as a principle: 'Owner entries are recorded too — an audit log that exempts the most powerful account is not one.' The throttle key is a fix with a number attached, dated Keith 08-13: keying on path 'meant every distinct endpoint got its own throttle slot, so a single visit wrote hundreds of identical ENTERED AN ACCOUNT rows — 270 in one session — burying everything the person actually did and making the log worse than useless.' Placing the write at the resolution point rather than the call sites is the other half: 'those two places are where this is called from, so there is no I forgot to log it here.'
- Support access with no durable record of who, when or why.
- A per-request log burying the meaningful events under hundreds of duplicates.
- Logging scattered at call sites drifting out of coverage.
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →