Learn how impersonation is used in cybersecurity and identity management, and how AI agents can use this feature.
Impersonation is a built-in feature of Logto, and in this article, we’ll explain what it is and when it can be used. As AI agents become more common in 2025, we are seeing more use cases involving impersonation in cybersecurity and identity management.
Impersonation in the authentication and authorization field is when a system or user temporarily assumes the identity of another user to perform actions on their behalf. This is typically done with proper authorization and is different from identity theft or malicious impersonation.
A common example is when you have a problem with your account and email the customer service team for help. They check your account on your behalf to troubleshoot the issue.
There are a few typical steps involved in the impersonation flow.
The impersonator can then perform actions or access resources as if they were the impersonated user.
Just like what we mentioned above, in customer support scenarios, impersonation allows support agents or administrators to access user accounts to diagnose and resolve issues without requiring the user’s credentials.
Here are some examples
AI agents can leverage impersonation to act on behalf of users, performing tasks automatically or assisting with workflows. As AI becomes more involved in business processes, impersonation plays a key role in enabling autonomous actions while ensuring identity security and access control.
Here are some examples
Impersonation is also commonly used for auditing, testing, and quality assurance purposes. By impersonating different roles, admins or testers can check user experiences, workflows, and permissions to ensure system performance and quality.
Here are some examples
Delegated access allows one user to perform actions on behalf of another, often seen in enterprise and team collaboration settings. This use case differs from typical impersonation because both the actor and delegator identities are preserved.
Here are some examples
Impersonation allows a user to temporarily act on behalf of others within the system, which gives them significant power and control. That’s why it’s necessary to address several security considerations to prevent misuse.
Log every impersonation action, including who did it, what was done, when it happened, and where it occurred. Make sure the logs show both the impersonator and the impersonated user. Store logs securely, set reasonable retention periods, and enable alerts for any unusual activity.
Only allow authorized roles (e.g., support agents) to impersonate. While limit impersonation scope (e.g., support agents can only impersonate customers not admin). Follow the principle of least privilege and regularly review permissions to keep things secure.
Sometimes, the flow should include consent and notifications. For example:
As AI agents become more prevalent in 2025, impersonation is increasingly used to enable agents to act on behalf of users while maintaining security and accountability.
Here are some practical use cases:
Scenario: A user contacts support via chat for account issues. The AI agent accesses their account and performs actions without needing the user’s password.
How does it work, and how is it designed?
Scenario: An AI agent monitors user sessions and locks compromised accounts automatically.
How does it work, and how is it designed?
Scenario: In a project management tool, an AI agent automatically assigns tasks and updates status on behalf of team members.
How does it work, and how is it designed?
Based on the above scenarios, there are a few principles designed in mind to achieve those goals.
Logto supports impersonation through its management API.
Check out this guide - user impersonation for more details. Logto also offers additional features that integrate impersonation, supporting real-world product scenarios.
| Features | Description | Doc link |
|---|---|---|
| Role-based access control | Assigning permissions to users based on their roles | https://docs.logto.io/authorization/role-based-access-control |
| Custom token claims | Add customize claims within access tokens. | https://docs.logto.io/developers/custom-token-claims |
| Audit logs | Easily monitor user activity and events. | https://docs.logto.io/developers/audit-logs |