In some cases we would like to allow a user to impersonate another user, but only a limited subset of users. E.g., department heads should be able to impersonate a teacher within their departments only. The head should not be able to impersonate an administrator or a teacher within a different department. Ideally, this would be role-based, along with a capability to add users on an ad hoc basis.