Implementing Impersonation
&gt; if possible, disable user notifications&#x2F;emails when an account is being impersonated — or remind staff that impersonating a user will still generate emails, notifications, and dashboard events.<p>Never, ever disable notifications. Notifications are the only way the user has to cross-check that the agent actually did the thing they were supposed to do, and only that thing.<p>I worked for a large benefits outsourcing corporation. We had impersonation, and we had a way for agents to cancel notification. A few agents realized they could change a participant address, get a 401k loan, and then cancel the notifications for those things. They used these combined capabilities to steal from our participants.