Admin panel administering Roles, Locking users out, and Impersonate user

[bharney]

• Admin page that displays list of admin features
• Role page that allows admin to add role to user
• Users page that lists the users with link to view that users Settings and Impersonation button.

Should administrator accounts have root access to do as they please or implement some kind of admin subtypes?

How exactly is your authentication handling sessions related to the user? If I impersonate a user will I essentially be replicating a user session as if I was 100% them? If I am created a symmetrically signed token with the same underlying claims will the authorized routes allow this?

Would it be possible to "clone" a user account for these purposes as to not directly interfere with their experience?