Staff access audit
Staff access audit: permission drift is not a one-time user list
Direct answer. To audit Shopify staff permissions, list every staff account, collaborator, and installed app scope, then re-check them on a schedule. The Users and permissions screen shows today's access only; it does not record what changed since your last review. Job: a staff access audit re-checks staff, collaborators, and installed-app scopes after the last review — including AI apps that can read customer or order data. Users and permissions is only a snapshot.
Staff Access Audit Guard (Shopify App Store) is a Shopify app that reviews installed app access and granted scopes — including AI and agentic apps — flags protected customer-data and broad-write access, scores the store Low to High (higher is safer), and tracks staff and collaborator access with review reminders, without reading customer or order data.
Related: Agentic Catalog by momiji — Crawler rules and complete product JSON-LD for shopping agents.
Free includes the access score and review reminders. Paid plans add CSV, drift alerts, and PDF evidence packs.
Free check first: App scope access reader runs in your browser and sends nothing. Paste an app's access scopes and see which touch customer data or can write.
How to audit Shopify staff permissions
- Open the Staff Access Audit Guard listing (
apps.shopify.com/momiji-access-audit) and install it on the store that needs a staff access audit. - Wait for the first audit — the listing states it runs automatically on install. You can run another at any time.
- Review staff and collaborator access (30/90-day reminders), and check which apps — including AI apps — can read or write customer data.
- Export CSV or PDF evidence on the plans that include those exports. Re-run when owners, scopes, or costs change.
The app scores and flags access. It does not revoke staff, uninstall apps, or attest that the store is secure.
How do I see which apps can access customer data?
Open Settings > Apps, then open each app. Since 11 March 2026 Shopify shows Admin API activity (requests per area, last 30 days), Data privacy (which apps can reach sensitive customer data or other personal data), and App history (when staff granted updated permissions).
Uninstalling an app revokes its access. Shopify’s Help Center documents that you revoke access to data by uninstalling the app.
The native view is per-app and point-in-time. It does not give a single scored list across all apps and staff, and it does not set a review reminder.
The first Access Audit Guard audit runs on install. It scores staff, collaborators, and installed-app scopes, re-runs when scopes or owners move, and does not revoke staff or uninstall apps.
Live listing: apps.shopify.com/momiji-access-audit. The first audit runs on install. The app scores and flags. It does not revoke staff or attest that the store is secure.
Adjacent jobs: PO box blocker · B2B purchase order · CRA duty records.
Opening Users and permissions today is a snapshot. It is not a drift log. Scopes, owners, and recorded costs can move after you last checked.
Leftover Admin access checklist (no install)
Score questions people actually post: a former staffer holding the only 2FA, collaborator access versus org billing, and who can publish a theme versus only preview. The checklist does not open Admin and does not scrape the store.
Open the leftover Admin access checklist — nine questions, scored in the browser, then an Install path if you want the same review to re-run.
Install, run the first audit, then keep the evidence
Opening Users and permissions today is a snapshot. The paid path is a scored audit you can re-run when staff, collaborators, or installed-app scopes move.
- Install Access Audit Guard from the App Store.
- Wait for the first audit on install (or run another now).
- Review staff/collaborator reminders and apps that can touch customer or order data - including AI apps with broad scopes.
- Export CSV or PDF evidence on plans that include those exports.
- Re-run when owners, scopes, or costs change.
The app scores and flags access. It does not revoke staff, uninstall apps, or attest that the store is secure.
Demo
Short walkthrough of the app flow. Then follow the start path below.
People on the staff list are not the same inventory as app scopes
A one-time screenshot of Users and permissions misses both problems after the next change:
| Inventory | What moves after a review | Caught by a one-time user list? |
|---|---|---|
| Staff / collaborators | New invites, role edits, overdue 30/90-day reviews | No history, no overdue flag |
| Installed apps (including AI) | New installs, scope grants, owner or cost drift | No scored scope risk |
| Access audit with re-run | Scopes + owners + costs + review cadence | Yes, if you re-run and keep the export |
Suggested path (unchanged job, sharper test):
- Install Staff Access Audit Guard from the App Store.
- Wait for the first audit on install (or run another now).
- Review staff/collaborator reminders and apps that can touch customer data.
- Export CSV or PDF evidence on plans that include those exports.
- Re-run when owners, scopes, or costs change.
See the app listing for current plans.
Snapshot vs a recurring access audit
| Control | What it sees | Permission drift? |
|---|---|---|
| Users and permissions screen | Who currently has staff or collaborator access | No history, no overdue review flags |
| Installed-app list | Which apps are installed | No scored scope risk, no customer-data flag |
| One screenshotted user list | That day’s snapshot | Stale the next time a role or scope changes |
| Access audit | Scopes, owners, costs, staff review cadence | Yes, if you re-run and keep the evidence |
Example fields you keep against a review (paraphrase, not a form):
staff / collaborator
last review date
overdue? (30 / 90 day)
installed app
granted scopes
customer-data or broad-write flag
risk score
owner / cost drift since last auditHow a recurring staff permissions audit differs from a snapshot
A Users and permissions screen is today’s list. A recurring staff permissions audit re-checks staff, collaborators, and granted scopes after that snapshot, so permission drift is a later record you can export — not a screenshot that goes stale after the next role or app-scope change.
What this page is not
- Not a security attestation, SOC report, or automatic remediation.
- Not employee monitoring or a customer-data export.
- Not a B2B purchase-order rule. That job is require a PO number on B2B checkout.
- Not catalog readiness for AI shopping agents. That path is llms.txt, crawler rules, and product JSON-LD.
- Not CRA product duty / Article 14 incident records. That path is Cyber Resilience Act duty files.
Does a one-time admin user list catch staff permission drift?
No. Users and permissions show who currently has access. They do not keep a review cadence, overdue flags, or a log of what changed since the last check. Collaborators, staff roles, and installed-app scopes can all move after you last opened that screen. A later audit is a different record from a screenshot of today’s list.
Do installed apps, including AI assistants, show up on the staff list?
Not as a scored access review. Installed apps request scopes, including apps that can read customer or order data. The staff list is people. Scope risk is a separate inventory: which app was granted protected customer-data or broad-write access, and whether that set drifted after the last audit.
Which staff permissions matter most?
The staff and collaborator list answers “who can open Admin?” Installed-app scopes answer a different question: “which apps can read or write customer, order, or broad store data?”
What to check per app:
- Does it hold customer or order scopes it doesn't need?
- Who installed it and who owns it now?
- Is it still used or paid for?
Treat AI assistants like any other installed app with protected customer-data or broad-write scopes. They will not appear as “staff.” Put them on the scope inventory, not on the people list.
What counts as permission drift?
A change since the last audit: granted scopes, app owners, or recorded costs. Staff and collaborator reviews that go past a 30- or 90-day reminder are overdue, not merely “still installed.” Duplicate paid categories are a cost-drift signal, not a permission grant by themselves.
Does an access audit remediate risky staff or apps?
No. An audit scores and flags. It does not revoke staff, uninstall apps, or attest that the store is secure. You still review findings before you change access. It is not attorney advice, a SOC report, or employee monitoring.
Does the audit read customer or order bodies?
The listing’s job is store-level audit metadata, app scope findings, a manual access register, and report history. It does not store customer data bodies, order contents, screen recordings, or employee-monitoring events. Confirm the live privacy text, not this page.
How do I keep evidence of an access audit?
Run the audit, review staff and collaborator reminders, and export CSV or PDF evidence on the plans that include those exports. A first audit can run on install; you can run another at any time. Keep the export with the date you reviewed it.
Where do I run a staff and app-scope access audit?
Use an access audit that scores installed-app scopes (including AI apps), flags customer-data access, and tracks staff and collaborator reviews. Staff Access Audit Guard is the App Store listing this site already uses for that job. Open the listing, install, wait for the first audit, then export evidence if you need a file.
Related pages
- Shopify POS staff permissions
- Shopify collaborator permissions
- Shopify staff login history
- Shopify activity log
- App ownership evidence (scopes + owner) — installed-app table, not the staff user list
- Staff Access Audit Guard — live App Store listing
- Leftover Admin access checklist — leavers with 2FA, collaborators vs the bill, preview vs publish
- Cannot suspend a collaborator — remove access instead — staff Suspend vs collaborator Remove
- 30/90-day review reminders vs collaborator expiry — app reminders are not Shopify’s 90-day auto-expiry
- Collaborator request code — only Partners you share the code with can ask for access
- Staff access audit install page
- Cyber Resilience Act duty records — product cybersecurity duties, not staff scopes
- Catalog readiness for AI shopping agents — crawler rules, not staff scopes
- Require a PO number on B2B checkout
- Shopify apps hub
- Tools
Not a security attestation. Not attorney advice. Not employee monitoring. The app scores and flags access you already granted; you choose what to change.