When Our Support Team Signs In as You
Every vendor that supports you can see into your system. The useful questions are who on their side did, when, for how long, and who else had to agree first. Here is how a sign-in by AWRA staff reaches your own evidence pack, and how the owner console can make our riskiest actions wait for a second person on our side too.
The finance manager of a Nairobi distributor raised a ticket on a Thursday: the month-end stock valuation would not reconcile. To see what she saw, somebody on our side had to look at her workspace as her administrator did. That is ordinary support, and it is also the single most privileged thing a software vendor does. Six months later her auditor asked the question every auditor eventually asks about a cloud system: who outside your organization has been inside it?
Most organizations cannot answer that from their own records. The vendor has a log, somewhere, and the customer has a promise. We think the answer belongs in the customer’s hands, in the same file they hand the auditor for everything else, and that the actions which could do the most harm on our side deserve the same control we ask you to put on yours: a second person before the change happens. It rests on an audit trail nobody can delete, ours included.
What reaches your evidence pack
When AWRA staff sign in to your workspace from the owner console, every request made during that session is logged against your organization. Your administrators can then build a compliance evidence pack, the export an assessor asks for, and choose the section on access by AWRA staff. It lists, for the period you pick:
| Row | What it shows |
|---|---|
| Each staff sign-in | Which staff member, the first and last request, and how many requests were made |
| Each owner-console request about your workspace | Who asked, when, when it was decided, its status and a one-line summary |
The pack files that section under user administration and privileged access, beside your own users, roles and permission changes, so an assessor reads our access to your data next to your own people’s rather than in a separate letter from us.
Why the count of requests matters
A sign-in that lasted forty minutes and made twelve requests is a support call. One that lasted forty minutes and made four hundred is a question worth asking. The pack gives you both numbers, so you can tell them apart without asking us first.
Three actions that can wait for a second AWRA owner
The same review engine that holds a loosened security policy inside your workspace can hold three actions in our owner console:
-
Signing in as a workspace
The request needs a reason. A different system owner approves it, and approval does not sign anybody in: it opens a 60-minute window for that one workspace, usable once, by the person who asked.
-
Overriding a plan permission
Allowing or denying a capability outside your plan needs a written reason and can carry an end date. Held, it applies only once a second owner approves.
-
Deleting a workspace from the owner console
Scheduling an organization for deletion from our side, which is the one action with no way back.
Two details close the obvious loopholes. The approver cannot use the window themselves, because the grant belongs to the person who raised the request and the workspace it names. And an approval nobody uses lapses after the hour rather than waiting for a quiet afternoon. If only one system owner exists, the same rule as in a workspace applies: they may approve their own request after 24 hours, and it is recorded as self-approved, which is a cooling-off period and a mark on the record rather than a second pair of eyes.
The vendor’s staff are the administrators you did not hire. They should be on your audit trail, not beside it.
Which of the three are held is a setting on the AWRA deployment, not a switch in your workspace, and we would rather say that plainly than let a diagram imply otherwise. If it matters to your review, ask us which are on for the service you use; every held request about your organization then shows in your evidence pack with its decision, so you can check the answer against the record.
What AWRA OpsHub does today
- Every staff sign-in to your workspace logged request by request, against your organization.
- An access-by-AWRA-staff section in your compliance evidence pack, with the staff member, first and last request and the request count for each session.
- Every owner-console request about your workspace in the same section, with who asked, when it was decided and its status.
- A second-owner hold available on three owner-console actions: signing in as a workspace, a plan permission override and deleting a workspace.
- A sign-in approval that is a 60-minute window for one workspace, usable once and only by the person who asked.
- A required reason on every held request, and self-approval only after 24 hours when no other owner exists, recorded as self-approved.
More we can add to your workspace
- A notice to your administrators the moment AWRA staff sign in, by email and in the bell.
- A consent switch in your own workspace, so a staff sign-in waits for one of your administrators as well as one of ours.
- A live list of staff sign-ins on your security screen, alongside the evidence pack export.
Where we point you to a specialist
- We will not leave a staff sign-in out of your evidence pack. If someone on our side was in your workspace in the period you chose, the section shows it.
The consent switch is the one regulated organizations ask for first, and it uses the same review engine that already holds our owner-console actions.
Staff access on your terms
The log, the evidence section and the second-owner hold are in place. These three extensions put more of the control on your side.
A notice when staff sign in
An email and a bell entry to your administrators at the start of every session, with the reason given.
Your consent before ours
A workspace switch that makes a staff sign-in wait for one of your administrators to approve it.
A live staff-access list
The same rows as the evidence pack, on your security screen, without building an export.
The short version
Ask any vendor two questions: can my auditor see your staff’s sessions in my own records, and can one person on your side sign in or delete my organization alone? In AWRA the first answer is yes, in your compliance evidence pack. The second depends on the deployment, and when the hold is on, the request, the reason and the decision are in that pack too.
Three questions for any vendor
How many times did your staff sign in to our system last quarter?
What you will probably hear
We would have to check.
How to read it
Then the record is theirs, not yours. Ask for it in a form your auditor can file.
Can one of your engineers delete our account without anyone else agreeing?
What you will probably hear
Only senior staff can do that.
How to read it
Seniority is a rank, not a control. Ask whether a second person has to approve it.
When your support team looks at our data, what stops them looking for longer?
What you will probably hear
They are trained not to.
How to read it
Training is a policy. A window that closes after an hour is a control.
See compliance evidence packs
One export for an assessor: users and roles, permission changes, change reviews, AWRA staff access and the audit trail, mapped to the controls they evidence.
Explore evidence packsFrequently asked questions
Can we see when AWRA staff signed in to our workspace?
Yes. Build a compliance evidence pack and include the section on access by AWRA staff. It lists each staff sign-in in the period you choose, with the staff member, the first and last request and how many requests were made.
Does a staff sign-in need a second person to approve it?
It can. Signing in as a workspace is one of three owner-console actions that can be held for a second AWRA system owner. Which are held is set on the AWRA deployment rather than in your workspace, so ask us which are on for the service you use.
What does approving a staff sign-in actually allow?
A 60-minute window for the one workspace named in the request, usable once, by the person who asked. The approver cannot use it, and an unused window lapses.
Can AWRA change what our plan allows without telling us?
A plan permission override needs a written reason and can carry an end date, it can be held for a second owner, and every such request about your workspace appears in your evidence pack with its status.
Can our own administrators approve a staff sign-in?
Not today. A consent switch that makes a staff sign-in wait for one of your administrators is something we can add, using the same review engine.
