Least-privilege permission set practices for store users
Key Takeaway
Give each user the narrowest permission set that covers their job. Grant commerce object access through permission sets assigned only to buyers and buyer managers, not through profiles.
B2B Commerce comes with preconfigured permission sets for each store persona. Least privilege means each user gets only the permissions their job needs. In practice, you pick the narrowest persona set, clone and trim it when needed, keep admin sets rare, and tie product access for external users to permission sets instead of profiles.
Start from the persona sets
Salesforce recommends assigning permission sets that grant users only the permissions they need to do their jobs. B2B Commerce provides preconfigured permission sets for these personas:
- Buyer (B2B stores only)
- Buyer Manager (B2B stores only)
- Shopper (D2C stores only)
- Merchandiser
- Commerce Admin
Not every permission in a preconfigured set is needed for every task of that persona. Start from the narrowest set that covers the user's job, and clone it to trim it when needed.