I think it's safe to permit admins to create workspaces for other users, but we should continue being careful with our approach to compute access for the reasons outlined in #2135. TL;DR arbitrary workspace access from an admin / group manager to a workspace exposes the users' non-Coder accounts. E.g, an admin in our dev deployment could use the credentials from my workspace to masquerade as me on GitHub, which makes me uncomfortable.

I could also see this being a "root user" only feature.

If we seriously believe in the pattern of someone creating a workspace for a new user, then it should be made in a fashion where more users can safely do it. The superadmin role should only be used for automation, setup, and the occasional configuration. It's too much of a security risk otherwise.

I think we could build it where they enter parameters and create the workspace but can't shell in afterwards. Either way this seems like something we should wait on more user feedback before building due to the uncertainty.

The only use cases I could think of are automation (in issue description), hence the comment about it being a root feature.

Agree we it's something we can wait on for feedback.

As an admin of the service, I find it very important to be able to perform some actions on behalf of a user, specifically creation and deletion. In our developer systems today, we already have many ways in for support and maintenance purposes.

There's always out-of-band ways in anyway. At an enterprise level, someone will have great access than the user. The administrator of the server can exec into Docker containers. An admin of a Kubernetes cluster can still exec into a pod. An EC2 admin can use SSM or a launch key to get in potentially, or just stop the instance and mount the volume somewhere else.

Re: the credentials bit, on our dedicated instances, we rely mostly on the policy that one should forward their SSH agent into their instance and always encrypt their key on their laptop. Not sure how that paradigm could transfer to a web-based workspace though.