Support people should never require customer's password, and they should have to get explicit permission to access their account. For example, they can get acc

Support people should never require customer's password, and they should have to get explicit permission to access their account. For example, they can get access to basic information and option to reset password, if user forgets the password. For anything else, they should get explicit permission (or it can be granted automatically when user opens a support ticket when he/she is logged in, if that's properly specified when creating a ticket).