One phrase, two decisions
"Give them access" is one of the most overloaded phrases in store operations. It almost always covers two separate decisions, and most access mistakes come from making them as one.
What they can change in the admin. A Shopify staff account lets someone sign in and do whatever their permissions allow: view orders, edit products, issue refunds, change settings. This is access to the business itself, and Shopify's permission model is what governs it.
How much of the conversation they see. Which rooms, which alerts, which tasks. This is access to coordination, and it is governed by whatever tool your team coordinates in.
These are layers on the same person, not a choice between two options. Anyone using a tool embedded in your admin needs a staff account to open it. The question worth asking is not whether to give someone an account, but how small that account can be, and how much of the conversation the account should carry with it.
Why the conflation happens
Because for a long time it was true. If someone needed to know what was happening with orders, the only way to show them was to give them somewhere they could look at orders, and that meant admin.
So the reflex developed: new person, needs to be involved, create a staff account. The reflex is now often wrong, but reflexes outlive their reasons.
What a Shopify staff account actually grants
Shopify's permissions are reasonably granular, and you can restrict a staff account meaningfully. That is worth knowing, because it means the choice is not binary.
The things worth understanding:
- Permissions are per-area, not per-record. You can grant access to orders. You cannot generally grant access to some orders and not others.
- Staff account limits depend on your plan. On lower plans the number of staff accounts is capped, which means the decision has a cost as well as a risk.
- Some permissions imply others. Certain areas cannot be usefully restricted without breaking the workflow you granted them for.
- Customer data is the sensitive part. Order access generally means access to names, addresses and contact details, which brings data-protection obligations with it.
None of this makes staff accounts wrong. It makes them a decision that deserves a moment's thought rather than a reflex.
The test: does this person need to do things, or know things?
This is the whole decision, and it resolves most cases in seconds.
Doing things means changing the state of the store. Fulfilling orders, editing products, issuing refunds, updating inventory. That requires a staff account with the relevant permissions, and there is no way around it.
Knowing things means being informed and participating in coordination. Knowing a launch is Thursday. Being told stock is low. Being assigned a task. Discussing how to handle a complaint. None of that requires the ability to change anything.
Both kinds of person need an account. The difference is what that account carries. Run through your team: in most stores a meaningful number of people who only ever needed to know things were handed the ability to do things, because that was how the request was phrased and because scoping it down took longer than not bothering.
Common cases
The social media freelancer
Needs to know what is launching, when, and what stock looks like. Rarely needs to change anything. Their account should be close to the minimum, and frequently is not: it ends up carrying order access they have no use for, which is customer data you are now accountable for.
The virtual assistant handling customer emails
Genuinely needs to look up orders, so this one probably does need a staff account, scoped narrowly. The mistake here is usually granting more than orders because it was quicker than configuring properly. We covered the specifics in giving a VA access without giving away the store.
The seasonal packer
Needs to know what to pack and to flag problems. Whether they need admin depends entirely on whether your fulfilment happens in admin or on paper or in a warehouse system. Worth actually checking rather than assuming.
The agency that built your theme
Needed extensive access during the build. Almost certainly does not need it now. This is the most common source of lingering access, because nobody wants to send the awkward email and there is no natural moment that forces it.
The founder's partner who helps at weekends
The trickiest case, because trust is high and the arrangement is informal. High trust is a reason not to worry about intent. It is not a reason to skip the record of who has access, because the risk is a compromised account rather than a person behaving badly.
The practical arrangement
For most stores this works:
- A staff account for everyone who needs to be in the workspace, scoped to the areas they genuinely use and no further.
- Broader permissions only for the people who actually change the store, which is usually a smaller group than the one holding them today.
- Roles inside the workspace deciding what each person sees, so having an account does not mean seeing every conversation.
- A written record of who has what, reviewed when anyone leaves or a project ends.
This is how Store Huddle is built. Everyone needs a Shopify staff account, because the workspace opens inside your admin, but that account can be scoped as narrowly as the job requires. On top of it sits a role that determines which rooms and categories the person sees. So the two decisions stay separate: what they can change in the store, and how much of the conversation they are part of.
The audit worth doing today
List everyone with a Shopify staff account. For each, answer two questions: what do they change in admin, and when did they last do it?
Anyone who cannot answer the first question is carrying permissions they do not use, and those should come off. Anyone whose answer to the second is "months ago" is worth a conversation about whether the account should still exist at all.
This takes about twenty minutes and is the highest-value security work most small stores can do, precisely because it needs no new tooling and no budget. It just requires someone to actually look.
Common questions
How many Shopify staff accounts can I have?
It depends on your plan, with higher plans allowing more. Since the limit is a real constraint on lower plans, it is worth checking before deciding everyone needs one.
Can I limit a staff account to specific orders?
Permissions are granted by area rather than by individual record, so restricting someone to a subset of orders is not generally possible. This is one reason coordination access and admin access are worth separating.
Does someone need a Shopify account to use Store Huddle?
Yes. The workspace runs inside your Shopify admin, so every member needs a staff account on the store. What the workspace adds is a role that decides which rooms and categories they see, independently of what their Shopify permissions let them change.
What should happen when a contractor finishes?
Remove the staff account rather than leaving it dormant, and remove or downgrade their workspace role. Doing both at the same moment is what stops one being forgotten.
Is it safer to give fewer people staff accounts?
Generally yes, since each account is a way in and most incidents involve credentials rather than deliberate misuse. Fewer accounts, each scoped to what the person does, is the sensible default.
Doing the audit
Twenty minutes, no tooling, and it is the highest-value security work available to most small stores.
List everyone with a Shopify staff account. Against each, answer two questions: what do they change in admin, and when did they last do it? Anyone without a specific answer to the first does not need the account. Anyone whose answer to the second is measured in months probably does not either.
Then check what is not a staff account, which is where lingering access usually hides: shared documents, courier portals, email platforms, ad accounts, and anything set up on a contractor's email address during a project.
Expect to find at least one account belonging to someone who stopped working with you a while ago. Most stores that have never run this exercise do.
Getting the split right from the start
For a new joiner, decide both questions separately and in this order.
First, do they need to change anything in the store? If no, they still need a staff account to open the workspace, but it can carry almost no permissions, which is the right answer for a surprising share of people involved in store operations.
If yes, scope the staff account to the areas those changes require, and nothing else on the basis that it might be convenient later. Later is a request that takes thirty seconds to approve; standing access is permanent until somebody remembers to remove it.
Then decide the workspace role separately: which rooms they see, and which they do not. The two decisions are independent, and treating them as one is what produces contractors with admin access because they needed to be kept informed.
The one-line rule
If they need to change something in the store, they need a staff account, scoped to what they change. If they only need to know things, they need a workspace role and nothing else.
Almost every over-permissioned contractor traces back to those two being treated as a single decision.
Worth doing today
The audit above takes twenty minutes, needs no budget and no new software, and reliably turns something up. It is the cheapest security work available to a small store, and almost nobody does it until something has already gone wrong.