Shopify unified staff permissions: an access-governance review for retail teams

Shopify announced on June 11, 2026 that POS and admin staff management is unified in Settings > Users. According to the Shopify changelog, merchants can manage POS users, roles and PINs from that area. Shopify also says existing users, permissions and roles were migrated automatically so people retained their current access.

The immediate task is an access-governance review, not a wholesale redesign. Confirm that every active identity still serves a current business purpose, reaches only the intended shops and holds an appropriate combination of roles. Pay particular attention to seasonal accounts, multi-store profiles and people expected to administer roles. This review framework is CreatikLab guidance; it is not a claim that Shopify automatically validates whether inherited access remains necessary.

Keep the review focused on Shopify operations. The update does not state that unified staff management changes Google Ads, Merchant Center, product feeds, analytics, attribution or advertising performance. If a campaign depends on work performed in Shopify, document that dependency separately instead of treating a Shopify role as proof of access to another platform.

For Shopify Plus organizations, POS staff can receive access to multiple shops through one user profile without duplicate profiles for that purpose. Shopify also says seasonal staff can be suspended or deactivated without deleting their accounts, then reactivated while keeping their history. Merchants can create custom roles and assign multiple roles to one person.

Shopify introduced the named high-trust roles POS Administrator, POS Device Setup, POS User Administrator and Organization POS Administrator. The important migration exception concerns role administration: creating, editing or deleting roles is now an organization-wide permission rather than a shop-level permission. Shopify did not automatically grant that broader access.

Someone who previously managed roles for one shop may therefore need Organization POS Administrator if the merchant wants that person to manage roles across the organization. Assigning existing roles remains possible with POS User Administrator, which Shopify says was assigned to people who previously held the corresponding permission. Shopify advises merchants that their user and role lists may need review and cleanup.

Start with the work that must be performed. A role label or job title does not establish the correct access by itself. For each identity, record the approved task, the relevant shop or shops, the required period of access and the person responsible for approving any exception. Then compare that requirement with what an administrator can actually observe.

CreatikLab separates four responsibilities: request, approval, implementation and verification. The requester explains the operational need. An accountable business owner approves the intended scope. An administrator implements the decision. A reviewer then verifies that the approved task can be completed without obvious unnecessary authority. A smaller team may combine responsibilities, but the record should still show who made each decision.

Review multiple roles as a combined access state. A person may need more than one role, which Shopify supports, but the decision should reflect the resulting access rather than the apparent narrowness of each role considered separately. Do not expand access merely because a broader role is convenient.

• Identity status — Record the user, current status and assigned roles. Match each active identity to a current operational purpose and flag identities that lack an accountable owner.
• Shop scope — Observe which shops a multi-store profile can reach. Compare that reach with the shops required for the person’s approved responsibilities.
• Sensitive authority — List holders of the high-trust POS roles named by Shopify. Document the task that requires each assignment and the person who approved it.
• Role administration — Identify anyone expected to create, edit or delete roles. Decide explicitly whether organization-wide authority is appropriate before assigning it.
• Seasonal lifecycle — Record whether an account is active, suspended or deactivated, why it may return and who will decide on reactivation.
• Combined roles — Examine the access created by all roles assigned to one identity. Resolve conflicts or unnecessary overlap through the merchant’s own approval process.
• External dependency — If a retail workflow also uses advertising, analytics or agency systems, keep a separate access record for each platform and link only the documented operational dependency.

This matrix is a CreatikLab diagnostic structure. Shopify does not prescribe these fields, owners or approval steps. Adapt the labels to the merchant’s organization, but require reviewable evidence, a decision and a named owner for every unresolved exception.

1. Define the review population, including active staff, seasonal identities, external providers and people holding sensitive roles.
2. Capture the current user status, roles and observed shop scope before making changes. Do not record or circulate passwords or PINs.
3. Match each identity to an approved task. Where no current purpose can be confirmed, route the account for a lifecycle decision rather than making an unsupported assumption.
4. For Shopify Plus organizations, compare multi-shop reach with the person’s approved operating responsibility.
5. Identify people expected to create, edit or delete roles and determine whether the merchant intends them to hold organization-wide authority.
6. Test a representative approved task with an appropriate non-owner account. Record whether the task succeeds, the shop involved and any exception requiring a decision.
7. Apply the smallest approved correction, then recheck the affected identity and close the item only when evidence and ownership are documented.

Avoid mass assignment as a shortcut. Shopify’s support for multiple roles and organization-level administration does not establish that broad access is appropriate for a particular merchant. The safe operational sequence is task, observed access, decision, controlled change and verification.

A useful control record reports the review population, identities matched to a current purpose, unresolved shop-scope differences, sensitive assignments awaiting approval, seasonal accounts awaiting a decision and corrective actions without an owner. Completion means the evidence has been reviewed and each exception has been resolved or consciously accepted by an accountable person.

Use a concise exception register rather than a vague completion percentage. Each entry should identify the affected identity, observed state, expected state, decision, action owner, approver and current disposition. If a change is reversed, preserve the reason for that reversal in the same record.

Do not use permission cleanup as evidence of sales or advertising improvement. Shopify does not report an effect on revenue, feed approval, lead quality, attribution or return on ad spend. If access governance supports a campaign workflow, measure that workflow under its own approved commercial framework.

• Do not treat automatic migration as proof that every inherited permission remains justified.
• Do not infer effective access from a familiar role name without observing the assigned roles and shop reach.
• Do not assume a former shop-level role manager automatically received organization-wide role-management authority.
• Do not treat suspension, deactivation and deletion as interchangeable decisions; apply the merchant’s own workforce and retention policies.
• Do not infer access to Google Ads, Merchant Center, analytics, CRM or agency systems from a Shopify identity.
• Do not invent pricing, rollout details, additional plan rules or performance effects that Shopify did not state.

When evaluating outside support, ask to see the proposed deliverable before granting access. A useful scope should produce an identity inventory, role and shop map, sensitive-access register, seasonal-account review, exception log, remediation ownership and final validation record. Reject any provider that substitutes broad access or performance promises for inspectable governance work.

If Shopify access is blocking or exposing a paid retail workflow, request a Retail Access Dependency Register as the concrete diagnostic deliverable within a Google Ads account audit. The register should map approved campaign tasks to the necessary Shopify identities, shops, account owners and unresolved sensitive-role decisions while keeping Shopify and Google Ads permissions separate.

The permissions review remains the scope of the deliverable; it should not become a general advertising pitch. If the register reveals an unresolved operating-model decision, use senior Google Ads consulting to define account responsibilities, campaign controls and handover requirements. The Google Ads Expert page helps identify the specialist route for senior review.

To start, open Lia and request a Retail Access Dependency Register. Include the shops involved, the teams that need Shopify access, whether seasonal staff are returning and the exact paid-workflow decision that is blocked. Do not send credentials, PINs or personal data.

Where are Shopify POS users managed after the update?

Shopify says POS and admin staff management is unified in Settings > Users. Merchants can set up POS users, assign roles and manage PINs there.

Did the migration remove existing access?

Shopify says existing users, permissions and roles were migrated automatically so current access was retained. Merchants should still determine whether inherited access remains appropriate.

Can one person hold multiple Shopify roles?

Yes. Shopify says merchants can create custom roles and assign multiple roles to one person. CreatikLab recommends reviewing the resulting combined access before approval.

Why might a former role manager need a different role?

Creating, editing and deleting roles is now an organization-wide permission. Shopify did not automatically grant that broader authority, so an explicit Organization POS Administrator decision may be required.

Do Shopify permissions also grant Google Ads access?

Shopify does not state that unified staff permissions control Google Ads, Merchant Center, feeds, analytics or attribution. Access to those systems must be reviewed separately.

What should a retail access-governance review deliver?

CreatikLab recommends an identity inventory, role and shop map, sensitive-access register, seasonal-account review, exception log, named remediation owners and a documented validation record.