List real jobs
Write down what each role does in a normal week: sell, refund, edit prices, view money, message customers.
Give the least access that still works
Most mistakes come from too many people having “full admin.” Start tight. Add access when someone is blocked.
Review quarterly
People change roles. A short review keeps permissions honest.