Team roles and their exact permissions
The complete permission matrix for the four roles: orders, products, settings, members, audit log and billing — with no ambiguity.
These are the actual permissions of each role, as the system enforces them.
The permission matrix
| Permission | Store owner | Manager | Staff | Viewer |
|---|---|---|---|---|
| Orders: read | ✔ | ✔ | ✔ | ✔ |
| Orders: write | ✔ | ✔ | ✔ | ✖ |
| Orders: export | ✔ | ✔ | ✖ | ✖ |
| Products: read | ✔ | ✔ | ✔ | ✔ |
| Products: write | ✔ | ✔ | ✔ | ✖ |
| Settings: read | ✔ | ✔ | ✖ | ✔ |
| Settings: write | ✔ | ✖ | ✖ | ✖ |
| Manage members | ✔ | ✔ | ✖ | ✖ |
| Audit log: read | ✔ | ✔ | ✔ | ✖ |
| Billing: read | ✔ | ✖ | ✖ | ✖ |
The differences people forget
- Manager resembles the owner but cannot write settings and cannot see billing.
- Staff reaches neither settings, nor billing, nor member management.
- Viewer is read-only — no writes at all.
Settings: write belongs to the store owner alone. It's the permission that allows changing the domain, payment methods and checkout form — the most sensitive controls in the store.