This is (one of) the big reason our team is moving over to Keycloak. It has full support for token exchange/impersonation and has a full audit trail along with

This is (one of) the big reason our team is moving over to Keycloak. It has full support for token exchange/impersonation and has a full audit trail along with it. You can get very granular about who can impersonate who.