Six roles built for a store, plus custom roles of your own. Everyone needs a Shopify staff account to open the app, and the role decides which rooms and categories they see once they are in it.
Store Huddle opens inside your Shopify admin, so everyone who uses it needs a Shopify staff account on your store. That is the first layer, and it is Shopify's to govern: what someone can view and change in the admin itself.
The second layer is the Store Huddle role: which rooms and categories that person sees once they are in the workspace. It is set per person and it is independent of what their Shopify permissions allow.
Treating these as one decision is where over-permissioning comes from. Somebody needs to be kept in the loop, so they are handed broad admin rights, because that was how the request was phrased. Shopify permissions can be scoped narrowly, and the role is what decides how much of the conversation they see.
Seasonal staff. Six weeks in November. They need what their shift requires, not the room where a customer complaint is being discussed. Scoping should be the easy path, because under time pressure nobody takes the diligent one.
Virtual assistants. Often need to look up orders, rarely need anything else. The scope should follow the five things they actually do this month, not what might be convenient later.
Agencies and freelancers. A room for the engagement rather than a seat in your general workspace. The general room is where the most incidental information about how your business runs accumulates, and it is the one contractors get added to without anyone thinking about it.
Granting access has a forcing function: someone cannot start work. Removing it has none. Nothing breaks, nobody is blocked, and no customer complains, so it gets deferred until a contractor who did one project still has access eighteen months later.
Roles make the removal a single change rather than an audit. What makes it actually happen is agreeing the end date when access is granted, which turns revocation from a judgement about a person into a policy that applies to everyone.
The defaults exist because the same handful of shapes come up in almost every store.
Admin and Manager for the people who run things. Staff for the general team. Fulfillment for people whose day is picking and dispatch, and who do not need the room where customer complaints are discussed. Virtual Assistant and Developer for outside help, scoped to the work rather than the business.
Build a custom role when an actual person does not fit one of those, not in anticipation. A role created for a hypothetical is a role nobody reviews, and roles that nobody reviews are how access quietly widens.
The decision made under time pressure on somebody's first morning is almost always "give them everything, sort it out later", and later does not come. Twenty minutes before the season starts avoids that entirely.
Decide three things in advance. Do they need Shopify admin at all? If they are packing from a picking list, often not. Which rooms should they see? Operational ones, yes; the room where you discuss suppliers or a customer complaint, probably not. When does access end? Put the date in a calendar the same day you set the start date.
Do not leave seasonal people out of the workspace to save a seat. A parallel group chat forms immediately, and now you have two records during your busiest weeks, which costs more than the seat.
Twenty minutes, no budget, no new software, and it reliably turns something up.
List everyone with access. Against each, answer two questions: what do they change, and when did they last do it? Anyone without a specific answer to the first does not need it. Anyone whose answer to the second is measured in months probably does not either.
Then check the things that are not accounts at all, because that is where lingering access hides: shared documents, courier portals, ad accounts, anything set up on a contractor's email address during a project.
Most stores that have never done this find at least one person who stopped working with them over a year ago.
Granting access has a forcing function: somebody cannot start work. Removing it has none. Nothing breaks, nobody is blocked, no customer complains. The only signal is an absence, and absences do not generate reminders.
There is a social cost too. Revoking access feels like a statement about trust, particularly with someone you liked and might work with again.
One sentence at the start removes both problems: access runs to the end of the engagement and is closed as standard. That turns revocation from a judgement about a person into a policy, and almost every professional expects it.
The principle is old and the usual objection is fair: in a six-person store everyone does a bit of everything, so tight permissions just create friction and someone ends up sharing a login, which is worse than the problem it solved.
The version that works at this size is narrower. Do not try to scope every person precisely. Scope the two or three things that would actually hurt, and leave the rest open.
For most stores that is a short list: anything that changes money, anything that touches customer data in bulk, and anything that changes access itself. Whoever can grant access can grant themselves anything, so that permission belongs with the owner and one deputy, and nowhere else.
Everything else can sit at the default. A member of staff who can see a room they rarely read costs you nothing; a contractor who can export your customer list costs you a great deal.
Roles here govern the workspace: which rooms someone is in, and what they can do inside it. That is a different thing from Shopify's own staff permissions, which govern the admin.
The two work together rather than replacing one another. Somebody can be in the fulfilment room without having permission to edit products, and somebody can have broad admin access while staying out of the private room where you discuss pay.
Reviewing both at once is the version worth doing, because a gap in either is a gap. The common shape is a contractor whose Shopify access was tightened carefully and who is still in every chat room a year later.
One practical note on seats: the free tier covers up to five people, so a small team can set roles up properly from the start rather than sharing a login and sorting it out later. Sharing a login is the single change that undoes everything else on this page, because it removes the one thing that makes any of it enforceable, which is knowing who did what.
Manager, Staff, Fulfillment, Virtual Assistant and Developer as built-in roles, plus custom roles you define. Each controls which rooms and categories the person can see.
No. The workspace opens inside your Shopify admin, so every member needs a staff account on the store. Their Shopify permissions can be scoped as narrowly as you like, and their Store Huddle role decides which rooms and categories they see.
Yes. A private room is closed but visible, so people know it exists and can ask. A private category is invisible to anyone outside it, for the narrow case where the existence of the conversation is the sensitive part.
Create a room for the engagement and give them a role scoped to it. Rooms named for a piece of work have a natural close-out point, which rooms named for a person do not.
Their access ends and the conversation stays. History remains searchable for whoever takes over, which is the opposite of what happens when the record lives in a personal messaging account.
Free for teams up to five, and about two minutes to connect your store.