Actions taken during an impersonation session are logged under the impersonated user, with no indication that an admin performed them via impersonation.

Ask: Add impersonation context to activity log entries, e.g. "Jane Doe (impersonated by admin@msp.com)," and make it filterable so it can be surfaced during an audit.