Common Roles and Their Policies
This guide suggests common roles you can create in the Medusa Admin and the policies each one typically needs. Use it as a starting point, then adjust the policies to match how your team works.
How to Read This Guide#
Each policy is written as resource:operation, where the operation is one of read, create, update, or delete. For example:
product:readallows viewing products.product:createallows creating products.
In the Medusa Admin, you select each policy individually. Operations are independent: granting product:update doesn't also grant product:read. So, to give a role full access to a resource, select all four of its operations.
Roles also often need read access to related resources to use a page without errors. For example, a product manager needs sales_channel:read to assign products to sales channels. These related policies are listed for each role below.
To find the exact policy keys available in your store, browse the Policies list in the dashboard.
To create any of these roles, follow the steps in the Manage Roles guide and select the listed policies.
Super Admin#
A super admin has full access to the store, including managing roles and policies.
Medusa provides a built-in Super Admin role with the *:* policy, which grants every operation on every resource. Assign this role to users who need full access.
You can also create a custom role and select all available policies. However, the role creation form only lists the policies that you hold yourself, so a custom role can't grant more access than you have.
Product Manager#
A product manager creates and maintains products, categories, inventory, and related resources.
Policies | Description |
|---|---|
| Manage products, their variants, and options, including option values. |
| Manage categories and collections. |
| Manage product tags and types. |
| Manage inventory items, stock levels, and reservations. |
| Related access: assign products to sales channels and shipping profiles, view stock locations, edit variant prices per region, and upload product media. |
Order Manager#
An order manager processes orders, returns, and exchanges.
Policies | Description |
|---|---|
| View and edit orders, including their addresses. |
| Manage order edits, returns, exchanges, and claims. |
| Fulfill orders, create shipments, and allocate items from stock locations. |
| View an order's payments and refunds, capture payments, and refund payments. Capturing and refunding also require |
| Mark an order's outstanding payment as paid, and settle an order's balance with a credit line. |
| View customer details, transfer an order to another customer, and view return and refund reasons. |
Customer Support#
A customer support agent manages customers and views orders to help shoppers.
Policies | Description |
|---|---|
| Manage customers and their addresses. |
| Add and remove customers from customer groups. |
| View and update orders, edit order addresses, and process returns to resolve issues. |
| Related read access for order pages. |
Marketing Manager#
A marketing manager runs promotions and campaigns.
Policies | Description |
|---|---|
| Manage promotions and campaigns. |
| Manage price lists for sales and overrides. |
| Related read access: select products and customer groups for rules, set prices per region, view a price list's prices, and read store currencies for campaigns. |
Read-Only Analyst#
A read-only analyst views data across the store without making changes.
To create this role, select the read operation for every resource, such as product:read, order:read, and customer:read. Don't select any create, update, or delete operations.