Post History

My first instinct would be to track *both* identities, using one for access control, and the other for audit purposes. 

For instance, rather than storing:

    User createdBy;

you'd store

    User createdBy; // for auditing
    User createdOnBehalfOf; // for access control

All access control logic would use `createdOnBehalf`, but the UI would show both, for instance like "created by ArtOfCode on behalf of meriton".

    
This makes impersonation transparent, while allowing the impersonator to use the application exactly like the impersonated user.

This is a pretty standard approach. For instance, when you send a mail in outlook on behalf of someone else, you see something like "From: Sue on behalf of Joe". Similarly, git tracks both the author and committer for every commit, clearly separating the person responsible for the content from the person responsible for its existence in a particular branch.

Of course, if tech support is the only reason for the existence of this impersonation feature, simpler solutions may exist. For instance, tech support could remote control the user's desktop using team viewer, thus ensuring impersonation happens only with the knowledge and consent of the person being impersonated.