Skip to main content
When you raise a support ticket, Ankra support may need to see what you see to help. They do that through a support session: a time-limited, recorded visit to your organisation that you can see and end at any time.

​
What a support session is

A support session acts as one member of your organisation, chosen by Ankra support when the session opens, and has that member’s permissions. It can never do more than that member can. Every session:
  • lasts at most one hour, then ends on its own
  • records a reason, and optionally the ticket it is for
  • shows the Ankra support person a banner saying they are in a support session
  • appears in your organisation’s list of support sessions and in the audit log

​
Read-only and elevated sessions

There are two kinds of session. Read-only is the default. Ankra support can look around as the member, but every change is refused. Elevated sessions can make changes, so Ankra support can apply a fix with you. Even an elevated session can never change:
  • members, invitations or roles
  • service tokens
  • single sign-on
  • anyone’s personal account, API tokens or MFA
  • billing
  • the support access settings on this page
In every session, read-only or elevated:
  • credentials are never handed out: kubeconfigs, agent tokens and secret values cannot be read
  • the AI assistant and terminals are not available
  • the support access settings and consent codes are hidden from Ankra support
An elevated session needs your consent. By default, that is a single-use consent code you give to Ankra support.
1

Create a code

An organisation owner or admin opens Organisation → Settings → Ankra support access and creates a consent code, choosing how long it is valid: 30 minutes, 1 hour, 4 hours or 24 hours.
2

Give it to Ankra support

The code is shown once. Copy it and send it to Ankra support, for example as a reply on your ticket.
3

Ankra support opens the session

Ankra support uses the code to open one elevated session. The code then counts as used and cannot open another.
A code that has not been used yet can be revoked from the same page. A revoked or expired code opens nothing.

​
Standing access

An organisation owner can instead allow elevated sessions without a code. Ankra support can then open an elevated session whenever they need one, and each one is still limited, time-boxed and recorded in the same way. Only an owner can turn this on or off, and turning it off goes back to requiring a code.
Standing access removes the step where someone in your organisation decides each time. Prefer consent codes unless you have a support arrangement that needs it.

​
Seeing and ending sessions

Organisation → Settings → Ankra support access lists every support session in your organisation. Every member can see the list. For each session it shows:
  • who from Ankra opened it
  • which member it acts as
  • whether it is read-only or elevated
  • the reason and the ticket reference
  • when it started, when it ends, and when it ended
An owner or admin can end an open session at any time, and it stops immediately: the Ankra support person’s next request is refused. Removing the member a session acts as from your organisation also ends the session.

​
Being told about sessions

You get a security notification when Ankra support opens a session in your organisation. It says:
  • who from Ankra opened it
  • which member it acts as
  • whether it is read-only or elevated
  • the reason
  • when it ends
You get another notification if a session is ended early. Both are delivered like your other security notifications, through the channels set up in your notification routes, and both appear in the app’s notifications.

​
Controls on Ankra’s side

Access by Ankra staff is also limited inside Ankra:
  • only designated Ankra support administrators can open an elevated session
  • Ankra staff must use a second factor to open any session
  • when an Ankra staff member’s access is removed, their open sessions end immediately

​
What is recorded

Everything done in a support session is written to your organisation’s audit log:
  • each action is recorded under the Ankra support person’s own Ankra email address, marked as a support session and naming the member it acted as
  • attempts the session was not allowed to make are recorded too, as support_session_request_refused
  • a session opening and ending is recorded as support_session_started and support_session_ended
  • creating and revoking consent codes is recorded as support_consent_created and support_consent_revoked, and changing the standing access setting as support_access_changed
When Ankra staff view your organisation from Ankra’s internal console, outside a support session, that view is recorded in your audit log too, as Ankra staff viewed this organisation (platform_staff_read). So an auditor can tell support activity apart from your own members’ activity, and see who at Ankra did what.

Support

Raise and follow support tickets.

Audit Log

Review every change in your organisation.

Roles & Access

The permissions a session inherits from the member it acts as.

Identity & Access Controls

The compliance view of access to your organisation.