How would you let a user safely switch between accounts they control?

Example answer

I would make adding an account an explicit user action. The person must authenticate to each account through the approved flow; adding an account must not be authorized solely because its IP address, device, payment details or behavior resembles another account. Those signals can inform risk checks, not replace authentication.

The switcher should clearly show which authenticated account is active and apply that account's own permissions to every request. It must not silently merge profiles, contacts, messages or entitlements. Account control does not necessarily mean common legal ownership: people may legitimately operate a delegated business account.

Protect account-add and switch operations against request forgery, bind sessions correctly, and require reauthentication or stronger checks when session age or the action's risk requires it. Logout, session expiry, account recovery and revocation must remove invalid access. On shared devices, provide an understandable remove-account action and avoid revealing private content in switcher previews.

Verification

Test unrelated users behind the same network, a shared family device, expired or revoked sessions, a compromised account and delegated roles. The server must reject an unauthorized account ID even if a client displays it. Track account-add failures, wrong-account actions and unauthorized access reports, alongside successful switching and usability.

Reference

NIST: authentication and session management. These principles support the authentication boundary; the product still requires its own threat model and authorization review.