> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Ankra Support Access > How Ankra support can open a time-limited support session in your organisation, what it can and cannot do, how you give consent for changes, and how every session is recorded. When you raise a [support ticket](https://docs.ankra.ai/platform/support.md), Ankra support may need to see what you see to help. They do that through a **support session**: a time-limited, recorded visit to your organisation that you can see and end at any time. *** ## What a support session is A support session acts as **one member of your organisation**, chosen by Ankra support when the session opens, and has that member's permissions. It can never do more than that member can. Every session: * lasts at most **one hour**, then ends on its own * records a **reason**, and optionally the ticket it is for * shows the Ankra support person a banner saying they are in a support session * appears in your organisation's [list of support sessions](#seeing-and-ending-sessions) and in the [audit log](#what-is-recorded) *** ## Read-only and elevated sessions There are two kinds of session. | | Read-only | Elevated | | - | - | - | | Opened | By default | Only with your consent | | Can look at what the member can see | Yes | Yes | | Can make changes | No | Yes, within the limits below | **Read-only** is the default. Ankra support can look around as the member, but every change is refused. **Elevated** sessions can make changes, so Ankra support can apply a fix with you. Even an elevated session can never change: * members, invitations or roles * service tokens * single sign-on * anyone's personal account, API tokens or MFA * billing * the support access settings on this page In every session, read-only or elevated: * credentials are never handed out: kubeconfigs, agent tokens and secret values cannot be read * the AI assistant and terminals are not available * the support access settings and consent codes are hidden from Ankra support *** ## Giving consent for an elevated session An elevated session needs your consent. By default, that is a single-use **consent code** you give to Ankra support. **1. Create a code** An organisation owner or admin opens **Organisation** → **Settings** → **Ankra support access** and creates a consent code, choosing how long it is valid: 30 minutes, 1 hour, 4 hours or 24 hours. **2. Give it to Ankra support** The code is shown **once**. Copy it and send it to Ankra support, for example as a reply on your ticket. **3. Ankra support opens the session** Ankra support uses the code to open one elevated session. The code then counts as used and cannot open another. A code that has not been used yet can be revoked from the same page. A revoked or expired code opens nothing. ### Standing access An organisation **owner** can instead allow elevated sessions without a code. Ankra support can then open an elevated session whenever they need one, and each one is still limited, time-boxed and recorded in the same way. Only an owner can turn this on or off, and turning it off goes back to requiring a code. > [!WARNING] > > Standing access removes the step where someone in your organisation decides each time. Prefer consent codes unless you have a support arrangement that needs it. *** ## Seeing and ending sessions **Organisation** → **Settings** → **Ankra support access** lists every support session in your organisation. Every member can see the list. For each session it shows: * who from Ankra opened it * which member it acts as * whether it is read-only or elevated * the reason and the ticket reference * when it started, when it ends, and when it ended An owner or admin can **end** an open session at any time, and it stops immediately: the Ankra support person's next request is refused. Removing the member a session acts as from your organisation also ends the session. *** ## Being told about sessions You get a security notification when Ankra support opens a session in your organisation. It says: * who from Ankra opened it * which member it acts as * whether it is read-only or elevated * the reason * when it ends You get another notification if a session is ended early. Both are delivered like your other security notifications, through the channels set up in your [notification routes](https://docs.ankra.ai/guides/notification-routing.md), and both appear in the app's notifications. *** ## Controls on Ankra's side Access by Ankra staff is also limited inside Ankra: * only designated Ankra support administrators can open an elevated session * Ankra staff must use a second factor to open any session * when an Ankra staff member's access is removed, their open sessions end immediately *** ## What is recorded Everything done in a support session is written to your organisation's [audit log](https://docs.ankra.ai/guides/audit-log.md): * each action is recorded under the Ankra support person's own Ankra email address, marked as a support session and naming the member it acted as * attempts the session was not allowed to make are recorded too, as `support_session_request_refused` * a session opening and ending is recorded as `support_session_started` and `support_session_ended` * creating and revoking consent codes is recorded as `support_consent_created` and `support_consent_revoked`, and changing the standing access setting as `support_access_changed` When Ankra staff view your organisation from Ankra's internal console, outside a support session, that view is recorded in your audit log too, as **Ankra staff viewed this organisation** (`platform_staff_read`). So an auditor can tell support activity apart from your own members' activity, and see who at Ankra did what. *** ## Related > [card] [Support](https://docs.ankra.ai/platform/support.md) > > Raise and follow support tickets. > [card] [Audit Log](https://docs.ankra.ai/guides/audit-log.md) > > Review every change in your organisation. > [card] [Roles & Access](https://docs.ankra.ai/guides/roles-and-access.md) > > The permissions a session inherits from the member it acts as. > [card] [Identity & Access Controls](https://docs.ankra.ai/security/identity-and-access.md) > > The compliance view of access to your organisation. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.