Just coming back from vacation. Also busier than ever

Typically you would create a separate resource that uses ash_authentication just like your user resource, as per your first message.

This sort of thing can get complex because how you write your policy logic needs to handle cases where the actor is an %Admin{}. But we’ve done the same thing in my current application. For masquerading, we do that with magic links and a special action that generates a magic link with a custom claim set.

You can control using options in your auth routes what resources to add route for, so you can have like /admin/sign-in etc.

I’d suggest asking around in the discord/searching there if you don’t get what you’re looking for here.

Welcome to the forum!

I can’t answer your question, but for clarification when a more Ash-skilled person comes online, are you asking about tenant-admins (a role for a tenant user capable of doing more within an org) or cross-tenant admins (a login for a system operator to access cross-org controls)? From your question about impersonation, I’d assume the latter, though I have seen single-tenant admin impersonation before.

I meant global admin that could manage all resources, impersonate users from different organizations and so on