Audit checkout access by mapping each person and app to the exact action it can perform: view orders, edit customer details, change checkout settings, capture or record payments, issue refunds, alter payment providers, manage discounts, or export data. These are different powers and should not be bundled together simply because a user helps with orders.
Inventory people, roles, and apps
List the store owner, administrators, staff, collaborators, point-of-sale users, agency accounts, custom apps, sales channels, and automation tools. Record the role or permission set, who approved it, its business purpose, and the last date it was confirmed. Investigate former staff, unfamiliar email domains, duplicate accounts, and integrations without a current owner.
Shopify documents granular order permissions for viewing, editing, capturing payments, fulfilling, returning, refunding, canceling, and exporting. It separately labels payment-settings management as a sensitive permission and notes that some choices automatically require related permissions. Review the current definitions in Shopify store permissions. Use the platform's actual permission screen as the source of truth because role names alone do not show every effective power.
Compare access with duties
Write the allowed tasks for each job. Customer support may need to view orders and update shipping details without changing payment providers. Fulfillment staff may need shipping functions without refunds. A finance role may need payout visibility but not theme or app-management access. Keep the store-owner account reserved for duties that truly require it.
Apply least privilege and separation of duties where the platform allows it. CISA recommends periodically reviewing accounts, removing unnecessary ones, and granting only the permissions needed for assigned work. See CISA's hardening guidance. Do not remove a critical account until recovery, billing, and ownership paths have been checked.
Inspect changes and sign-ins
Review user-management events for newly created users, role edits, deleted accounts, and unusual assignments. Shopify says its user-management activity log records when users or roles are created, edited, or deleted. It also provides recent login details, including date, IP address, internet provider, location, browser, and operating system, and recommends periodic review for unfamiliar access. See Shopify user activity and login history.
Match sensitive changes to an approved request. Unexpected activity does not automatically prove compromise, but it should be investigated with timestamps, named actors, installed apps, and recent support or agency work. Preserve evidence before revoking access.
Test without placing a real order
Use the platform's test or sandbox features to confirm that each representative role can perform required tasks and is blocked from restricted ones. Verify that a support account cannot alter payment settings, a fulfillment account cannot issue an unauthorized refund, and a removed collaborator cannot sign in. Do not enter a real card number into a test environment or make a live charge merely to check permissions.
Also inspect apps that touch checkout, payments, discounts, customer data, pixels, or order routing. Confirm each app's owner, requested scopes, installation purpose, and removal plan. After corrections, retest normal checkout administration and document exceptions, evidence, approver, and next review date. A sound result protects high-impact controls without blocking routine work.
Sources
- Store permissions — Shopify Help Center
- User activity and log in history — Shopify
- Enhanced Visibility and Hardening Guidance for Communications Infrastructure — Cybersecurity and Infrastructure Security Agency