ROLE_PREVIOUS_ADMIN is added to the token roles if the session is an impersonation. Since#31189 we have theIS_IMPERSONATOR attribute which can be used for the same reason. I propose to deprecate theROLE_PREVIOUS_ADMIN:

• This is not what roles are for (resulting in hacking this exception inAbstractToken)
• The role isn't very descriptive
• I don't like having 2 ways of doing exactly the same thing
• While every application with impersonation enabled probably needs to be updated, the update is as simple as replacingROLE_PREVIOUS_ADMIN withIS_IMPERSONATOR:find ./ -type f -exec sed -i 's/ROLE_PREVIOUS_ADMIN/IS_IMPERSONATOR/g' {} +

I'm a bit unsure on how to deprecate this role, but I think having it inRoleVoter is probably the safest (isGranted() and variants +AccessDecisionManager#decide() all use this voter to check if the token has this role).