4 articles
Turn on single sign-on
Connect your identity provider, and confirm that a real person can sign in through it before you make it compulsory.
When our support people can see your account
Support can only work inside your account under consent you granted, every action they take is recorded as theirs, and both the consent and the session are visible to you.
Who can see what
A role sets how far across your business somebody can see each kind of record, and totals are computed from what they can see rather than filtered afterwards.
Your audit trail
Every privileged and record-changing action writes a row you can read, the rows are chained so a removal is detectable, and the trail is yours rather than ours.