It would be nice if there was a permission to impersonate that was view only. It would be helpful to be able to allow a user to impersonate a user w/o them having the ability to change any settings, etc. for that user.