What access each kind of person on a store team actually needs, the two layers that control it, and the end date that makes removal routine.
Access decisions get made once, quickly, usually while someone is waiting to start work, and then never revisited. That is how stores end up with active accounts belonging to people who left, and with contractors holding permissions nobody remembers granting.
Two layers are involved and they are set separately. Shopify permissions decide what a person can do in the admin. The Store Huddle role decides which rooms they see in the workspace. Every team member needs a Shopify staff account, because Store Huddle runs inside Shopify admin, and the workspace role sits on top of that rather than replacing it.
The single change that does most of the work is agreeing an end date at the moment access is granted. It converts offboarding from a judgement call somebody has to remember into a diary entry.
Usually granted far more than the work requires, because narrowing it takes longer than not.
The agency that asks for less access than you expected to give is telling you something useful.
The role where access looks technical and is mostly about what happens when the project ends.
Close to the inverse of a virtual assistant: they need exactly the access everyone else is refused.
The narrowest role in most stores, and the one most often given a login that does far more.
The access question here is really a decision-limit question wearing different clothes.
The only role where the leaving date is known in advance, and the one where access most often outlives it.
The role where the interesting question is not what they can see, but what they can decide without asking.
Nobody over-grants marketing on day one. It happens one reasonable request at a time over two years.
The device is the risk, not the person, and a shared login removes the only record of who did what.
Copying someone's permissions without copying their decision limits creates a person who can act and will not.