Challenge 1 / 2

We pointed switch_user at a custom attribute, and deliberately left the ROLE_ prefix off the name:

# ...
switch_user:
    role: CAN_IMPERSONATE

Why does leaving that prefix off matter?

Symfony's packaged role voter only votes on attributes that start with ROLE_, so dropping the prefix keeps it out of this decision entirely.

The role option under switch_user rejects any value that already appears in role_hierarchy.

Only attributes without a ROLE_ prefix can be passed a subject, so our voter would never see the target user.

Without the prefix, the check skips the access decision manager and goes straight to our voter.