What access each kind of person on a store team actually needs, the two layers that control it, and the end date that makes removal routine.
Access decisions get made once, quickly, usually while someone is waiting to start work, and then never revisited. That is how stores end up with active accounts belonging to people who left, and with contractors holding permissions nobody remembers granting.
Two layers are involved and they are set separately. Shopify permissions decide what a person can do in the admin. The Store Huddle role decides which rooms they see in the workspace. Every team member needs a Shopify staff account, because Store Huddle runs inside Shopify admin, and the workspace role sits on top of that rather than replacing it.
The single change that does most of the work is agreeing an end date at the moment access is granted. It converts offboarding from a judgement call somebody has to remember into a diary entry.
Usually granted far more than the work requires, because narrowing it takes longer than not.
The agency that asks for less access than you expected to give is telling you something useful.
The role where access looks technical and is mostly about what happens when the project ends.
The narrowest role in most stores, and the one most often given a login that does far more.
The access question here is really a decision-limit question wearing different clothes.
The only role where the leaving date is known in advance, and the one where access most often outlives it.