Even a team of two can separate who sets the rules, who runs the store and who reviews orders against those rules. Three roles cover most small research supply businesses: an owner who is accountable for the compliance profile, an admin who runs the store and its settings, and a compliance reviewer who decides on held orders and monitoring findings. Add individual logins and a log of every admin action, and you have controls that do not rest on one person's word.
This guide explains each role, how to apply separation of duties when people wear more than one hat, and how to use the role systems in the tools you already have.
Why roles matter at small scale
NIST's glossary describes separation of duty as the principle that no user should be given enough privileges to misuse the system on their own, with the example that the person authorizing a paycheck should not also be the one who prepares it.
In a store, the equivalent risk is one person who can change a hold rule, approve the order it would have held, and edit the record afterwards. That might never be misused. The problem is that nobody can show it was not. When a processor or reviewer asks how an order was approved, "I checked it myself" is a weak answer if the same person could also change the rules.
The three roles
Owner
- Accountable for the compliance profile: who the business sells to, what it sells and on what terms.
- Approves changes to policies, checkout statements and hold rules before they go live.
- Controls access: who has which role, and when access is removed.
- Makes the final call on escalated orders and disputed decisions.
Admin
- Runs the store day to day: product pages, settings, integrations and policy pages.
- Puts approved changes into effect, rather than deciding them alone.
- Fixes monitoring findings and records what was changed.
Compliance reviewer
- Reviews orders that a rule has held, and approves or refuses them with a recorded reason.
- Reviews weekly monitoring findings and decides which need action.
- Ideally cannot change the rules, settings or records they are reviewing against.
Separation of duties when you are two or three people
Perfect separation is not possible with a tiny team. The aim is that no single person can both make and approve a change without someone else being able to see it. Some practical patterns:
- Two people for rule changes. One person drafts a change to a hold rule or statement, the other approves it. If that cannot happen before the change, review it within the week.
- No self-approval. Nobody approves a held order they placed, or one from a buyer they have a personal connection with.
- A second look at larger refunds. Set a level above which a refund needs a second person's approval.
- Weekly log review. The owner reads the admin action log once a week. If the owner is also the only admin, ask an adviser or business partner to look at it periodically.
- Compensating controls. Where one person must hold two roles, make up for it with logging and after-the-fact review, and write down that this is what you have chosen to do.
Use the role systems you already have
Most tools already offer roles. Use them rather than sharing one login.
Stripe's Dashboard has a long list of user roles. It describes the Administrator role as having similar access to the account owner, and lists narrower roles such as Analyst, Dispute Analyst, Refund Analyst, Support Specialist and View Only, each with a defined set of permissions. There is only one account owner, who can perform all actions including closing the account. Stripe's documentation also notes that:
- Assigning someone several roles gives them all the permissions of each role, so be cautious of conflicts and unintended authority.
- Roles that can invite users are sensitive: if an attacker compromises one, they can invite more users under their control.
- Only the account owner, administrators and developers can create Radar rules.
- Several roles, including View Only, can view security history audit logs.
Map your own three roles onto the narrowest Stripe roles that let each person do their job. Do the same in your store platform.
Log every admin action
- Individual logins only. Shared accounts make every log entry useless, because nobody can tell who did what.
- Log changes, not just logins. What changed, the old and new values, who changed it and when.
- Keep logs where the person being logged cannot edit them. A log the admin can quietly rewrite does not show much. Tamper-evident records, explained covers one approach.
- Read the logs. A log nobody reviews is a record for later, not a control. Put the weekly review in the calendar.
Joiners, movers and leavers
- Give new people the narrowest role that covers their work, and widen it only when needed.
- When someone changes job, remove the access they no longer need, not just add new access.
- When someone leaves, remove their access the same day, and rotate any shared credentials or API keys they could reach.
- Review the full list of users and roles every quarter, across every tool.
Write it down
Keep a one-page note that names who holds each role, what each role can approve, who covers when someone is away, and which compensating controls you rely on. It takes little time to write and answers the first questions a reviewer is likely to ask about your controls. Building a compliance audit trail explains how roles fit into the wider record.
How Claddr handles roles
Claddr has three roles: owners, admins and compliance reviewers. Held orders wait for a reviewer on the merchant's team to approve them before payment is captured, and every admin action is logged. See how Claddr works and reviewing orders that look like consumer purchases for how reviews run in practice.