Bypass sn_hr_core.impersonateCheck

[YvanMartino]

I have a select few users that need to be able to impersonate users without worrying about the sn_hr_core.impersonateCheck property being set to true.

I haven't found a recommended way of bypassing that property aside from toggling it back and forth on demand, which is going to be too cumbersome for our team, has anyone found a way that works for them?

I've considered editing the OOB Security Attribute (instead of the  100+ ACLs) to account for users that explicitly have  sn_hr_core.admin or are explicitly part of a very specific impersonator group of our creation; but we're trying to avoid editing OOB records as much as possible.

[Mark Manders]

The question is 'why'. You are saying that certain people should be able to see sensitive data while impersonating someone else. There is a reason they aren't allowed to see that data, so what is the use case that allows them to do so, while impersonating? Why? If you are allowing them to see that data while impersonating, just allow them to see that data, no matter what.
Or, provide them with a local account that has access to that data, so they can log in with their 'HR' account to see what they need to see. 

It just doesn't make sense to not allow them to see data without impersonation if they should be able to see it while impersonating.