Security Auditing, Impersonation & Audit Logs Manual

Target Role: Organization Admins & Compliance Officers

Audit logs and user impersonation controls are accessible under App Sidebar > Audit & Security Logs (or /org-admin/audit).

Overview

Dream Center Connect maintains enterprise-grade security auditing and compliant user impersonation capabilities. Organization Admins can troubleshoot field issues in context while all actions are bound to an immutable audit trail.

graph TD
    Admin["Organization Admin"] --> ActionType{"Action"}
    ActionType -->|Option 1| Impersonate["Launch Contextual Impersonation"]
    ActionType -->|Option 2| Audit["Inspect Audit Logs (/org-admin/audit)"]

    Impersonate --> Banner["Sticky Security Impersonation Banner Active"]
    Banner --> LoggedSession["All Actions Recorded with Dual-Identity"]
    LoggedSession --> Exit["Exit Impersonation Mode"]

    Audit --> Filters["Filter by Actor, Action Type & Date"]
    Audit --> CSV["Export Immutable Audit CSV"]

---

1. Contextual User Impersonation Workflow

When an Organization Admin needs to investigate operational issues or permissions experienced by a staff member:

1. Navigate to App Sidebar > Team Access.
2. Locate the target staff member in the user list.
3. Click the user action menu and select Impersonate User.
4. The system switches your active session view to match the exact permissions, assigned location, and interface layout of the target user.

---

2. The Persistent Impersonation Banner

Security Audit Banner

While in impersonation mode, a prominent, persistent orange Security Impersonation Banner remains pinned to the top of every screen.

The banner displays:

• Target User: Name and role currently being impersonated (e.g. Impersonating: Sarah Jenkins (Staff)).
• Performing Admin: Your original Organization Admin identity.
• Exit Action: A prominent Exit Impersonation button that immediately terminates the session and returns you to the Organization Admin dashboard.

---

3. Dual-Identity Audit Trail

Every operational action performed during an impersonated session—including creating needs, updating constituent records, or sending SMS messages—is recorded in the security audit trail:

• Dual-Identity Tracking: The audit entry explicitly captures:
  • actor_user_id: The performing Organization Admin.
  • target_user_id: The impersonated user identity.
  • action: Specific operation executed (e.g. PII_REVEAL, NEED_RESOLVE, CONSTITUENT_MERGE).
  • timestamp: UTC microsecond timestamp.
  • ip_address & user_agent: Network origin parameters.

---

4. The Audit & Security Logs Subpage

Organization Admins can review all system events under Audit & Security Logs (/org-admin/audit):

Filtering Options

• Actor Filter: Search by user email or admin name.
• Action Type Filter: Filter by categories:
  • AUTH: Sign-in, sign-out, password reset, and phone OTP verification events.
  • CREATE / UPDATE / DELETE: Entity modifications on needs, partners, and schedules.
  • PII_REVEAL: Staff access to unredacted constituent personal data.
  • MERGE: Constituent and household deduplication merges.
  • IMPERSONATION: Impersonation session start and termination events.
• Date Range Filter: Filter records by customizable calendar windows.

Exporting Audit Trails

Click Export CSV to download a cryptographically sequenced log file suitable for external compliance audits or board reviews.