Impersonation still needs authorization

When an admin or support tool lets someone "act as" another user, that mode is still an authorization decision — not a free pass. Check all of these before allowing impersonation: The actor is allowe