Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.runorion.com/llms.txt

Use this file to discover all available pages before exploring further.

Sudo lets an admin temporarily act as another user — useful when a teammate reports a bug you can’t reproduce, or when Gravity support needs to investigate something specific to your tenant. A banner sits across the top of every page during a sudo session so you always know you’re acting on someone else’s behalf, and every session is recorded in your tenant’s activity log.

​
Two ways to use Sudo

Sudo as a teammate

A tenant admin opens Manage Users, finds a user in their tenant, and clicks Sudo. No invitation needed — admins already have full authority in the tenant.

Grant Gravity support access

A tenant admin invites a Gravity support engineer by email and sets how long the access lasts. The engineer signs in through a dedicated Gravity-only entry point and can then sudo as a user in the tenant.

​
Sudoing as a teammate

  1. Open Settings → Manage Users.
  2. Find the user you want to act as.
  3. Click the Sudo icon on their row.
You’ll be redirected to the home page, now acting as that user. An amber banner appears across the top with the target user’s name and an Exit sudo button.
The Sudo button is only available to tenant admins, and only for active users in your own tenant.

​
Granting Gravity support access

If a Gravity support engineer needs to investigate something in your tenant, you can grant them temporary access from the Support Access section of Manage Users.
  1. Open Settings → Manage Users → Support Access.
  2. Click Grant access.
  3. Enter the Gravity engineer’s email address.
  4. Choose how long the grant lasts: 8 hours, 24 hours, 7 days, or 30 days.
  5. Add a short note describing the reason (e.g. a support ticket number). The note is required so the access is traceable.
The Gravity engineer can then sign in through Gravity’s dedicated support entry point. Once signed in, they pick a user to sudo as and a red banner appears across every page they visit — showing your tenant name, the note you wrote, and when the grant expires.
Granting access lets a Gravity engineer sign in to your tenant and act as one of your users. Only grant access in response to a request you initiated (a support ticket, an incident, or a scheduled investigation) and pick the shortest TTL that covers the work.

​
Revoking access

You can revoke a grant at any time. From the Support Access section, find the grant and click Revoke. Any sudo session running under that grant ends within 15 minutes — Gravity’s session is rechecked on a short timer, and a revoked grant fails the next check.

​
What changes during a sudo session

  • A banner is always visible — amber for intra-tenant sudo, red for Gravity support sudo. The banner shows who you’re acting as and an Exit sudo button.
  • Your normal session is preserved. Exiting sudo (or letting the session expire) drops you back into your own account, not the login screen.
  • A sudo session can do anything the target can do. This is intentional: the point is to reproduce what the target sees, including saving forms, running analyses, and editing settings. Be deliberate about destructive actions.
  • Everything is logged. Every action taken during a sudo session is recorded in your tenant’s activity log, along with the identity of the real driver — so “what did Drew do while signed in as Alice” is fully attributable.

​
FAQ

No notification is sent. Sudo activity is recorded in your tenant’s activity log, which admins can review.
A session lasts 15 minutes and refreshes silently every 12 minutes as long as you’re active. Exiting sudo or closing the tab ends the session immediately. For Gravity-support sudo, the underlying grant also has its own TTL (8 hours to 30 days) — once that expires, no new sessions can start, even if the engineer is mid-investigation.
Only tenant admins. Analysts and viewers do not see the Sudo button on the Manage Users page and cannot start a sudo session through the API.
Yes. Sudo events (session started, session ended, grant created, grant revoked) flow through the same activity stream as the rest of Orion. Contact your Gravity account team if you need a custom report.