A virtual assistant normally needs order viewing and editing, customer records and draft orders, and nothing else. The permissions most often granted unnecessarily are finance, apps and payouts, none of which any normal VA task requires. Grant the narrow set, add a Store Huddle role covering the rooms they work in, and agree an end date at the same time.
What this person actually does
A VA typically handles order enquiries, tracking questions, refunds within a limit, and routine data entry. All of that lives in orders and customers.
The reason over-granting is so common is not carelessness. It is that Shopify's permission list is long, the person is waiting to start, and full access is one click while a considered set is fifteen. The default path is the wrong one, and knowing that in advance is most of the fix.
There is a second reason to keep it narrow that has nothing to do with trust: a VA with minimal access cannot make an expensive mistake in an area they were never meant to touch. Narrow access protects them too.
The two layers
Shopify permissions decide what they can do in the admin. The Store Huddle role decides what they see in the workspace. Both are needed, and they are set separately.
| Layer | For this person | Why |
|---|---|---|
| Shopify staff account | Required | Store Huddle runs inside Shopify admin |
| Shopify permissions | Orders, customers, draft orders | The work is order-shaped |
| Store Huddle role | Virtual Assistant | Decides which rooms they see |
| End date | Set at grant time | Turns offboarding into a diary entry |
Shopify access to grant
Grant the smallest set that covers the actual tasks. Shopify's permission labels change from time to time, so these are described by what they control rather than quoted as exact checkbox names. Check the current names in your own admin.
- Orders: view and edit, so they can answer enquiries and correct addresses.
- Customers: view and edit, for contact details and history.
- Draft orders, if they create replacement or manual orders.
- Products: view only, unless updating listings is genuinely part of the job.
Access to withhold, and why
- Finance and payouts. No routine VA task requires seeing revenue or bank detail.
- Apps and channels. Installing or configuring apps is not VA work and is where expensive accidents happen.
- Settings. Store configuration should sit with the owner.
- Discounts, unless issuing them is explicitly part of the role, in which case set a value limit in writing alongside it.
Rooms they belong in
A VA does not need the whole workspace. Put them in the rooms where the work they do is discussed, and nowhere else.
- The customer or support room, which is where most of their questions arise.
- A room for their own handovers, if they work across time zones.
- Not management, finance or supplier rooms.
- Not the general room, if it carries internal discussion that has nothing to do with them.
Offboarding
Set the end date when access is granted, not when the engagement ends. This is the single change that stops VA accounts outliving VA relationships.
On the end date, remove the Shopify staff account rather than only the workspace role. Removing the workspace role leaves admin access in place, which is the half people forget.
Check anywhere else they were given access: a shared inbox, a helpdesk, a password manager. The store admin is rarely the only door.
Common questions
What Shopify permissions does a virtual assistant need?
Usually orders and customers, plus draft orders if they create manual orders, and product view. Finance, apps and settings are almost never required.
Do virtual assistants need their own Shopify staff account?
Yes. Store Huddle runs inside Shopify admin, so each team member needs a Shopify staff account. The Store Huddle role then controls which rooms they see in the workspace.
How do I stop VA access outliving the engagement?
Agree an end date at the moment you grant access rather than deciding later. It turns removal from something somebody has to remember into something already scheduled.
Should a VA have access to finance data?
Almost never. No routine VA task requires revenue or payout visibility, and withholding it protects them from being implicated if anything goes wrong.