Shopify Enterprise RBAC

Overview

Implement role-based access control for Shopify Plus apps using Shopify's staff member permissions, multi-location features, and Organization-level access.

Prerequisites

• Shopify Plus store (for Organization features)
• Understanding of Shopify's staff permission model

• read_users

  scope for querying staff permissions

Instructions

Step 1: Query Staff Permissions and Map to App Roles

Query staff members via GraphQL to get their access scopes, then map those scopes to app-level roles (admin, manager, fulfillment, viewer). Staff permissions mirror app scopes like

read_products

write_orders

See Staff Query and Role Mapping for the complete GraphQL query, role definitions, and matching logic.

Step 2: Permission Middleware and Multi-Location Access

In embedded apps, use online access tokens to get per-staff permissions from

session.onlineAccessInfo

See Permission Middleware and Location Access for Remix loader examples and location access control.

Step 3: Organization API and Audit Trail

Shopify Plus Organization API enables multi-store management with organization-level, store-level admin, and store-level staff roles. Log all access decisions (allowed and denied) for compliance auditing.

See Organization API and Audit Trail for the Organization query and audit implementation.

Output

• Staff permissions queried and mapped to app roles
• Permission middleware protecting embedded app routes
• Multi-location access control for Shopify Plus
• Audit trail for all access decisions

Error Handling

onlineAccessInfo

Examples

Quick Permission Check in Remix

// Remix action with permission guard
export async function action({ request }: ActionFunctionArgs) {
  const { admin, session } = await authenticate.admin(request);

  const role = determineRole(
    session.onlineAccessInfo?.associated_user_scope?.split(",") || []
  );

  if (!canPerformAction(role, "manage_products")) {
    return json({ error: "Insufficient permissions" }, { status: 403 });
  }

  // ... perform the action
}

Resources

• Shopify Staff Permissions
• Online vs Offline Tokens
• Shopify Plus Organization
• Multi-Location Inventory