Skip to content
Log in

Store roles for site inspection and site builder

On this page

Use store roles to grant users access to the website builder and the web console, both of which are opened from the Store record, and to decide what an AI agent connected as that user may do. Access is defined across two objects:

  • Store Role defines the type of access and its level.
  • Store User Role assigns a Salesforce user to a Store Role and sets which stores that assignment covers.

Create the Store Role first, then assign it. A user with no Store User Role has no access, even if a matching Store Role exists.

Two Content Changes roles are created for you: Content Editor and Content Approver. They arrive on a new install, and on an upgrade to package v21.12.0 or later for orgs that installed before the roles existed. Both carry the default API scopes for content work, so for most stores you only need to assign them. Create your own role when you need a different level or a narrower set of scopes.

Seeding never changes a role you already have. It matches on name, type and level and adds only what is missing, so a role you have renamed or narrowed is left alone. On upgrade, an existing Content Changes role at Editor level with no API Scopes is given the same defaults, so agents acting as those users keep working. An existing role at Approver level is not backfilled: open it and set its API Scopes by hand, or an agent acting as one of its holders will be refused every scoped action with nothing in Salesforce to say why.

Add a store role

  1. Go to the Store Roles list.
  2. Click New.
  3. Enter a Name for the role.
  4. Under Type, choose either:
    • Content Changes for the Website Builder.
    • Web Console for the Web Console.

    If a user needs both, create two separate roles, one for each type.

  5. In Level, choose what the role allows. The available levels depend on the type:
    • For Content Changes: Editor to make and submit content changes, Approver to review and publish them (an approver can also do everything an editor can), or Commenter to comment on changes without making any.
    • For Web Console: Viewer to open and inspect the store’s live logs.
  6. For a Content Changes role, select the API Scopes the role grants. These decide what an AI agent, or any tool using the website API, may do while acting as a user who holds this role. Anything not selected is denied. See What the API scopes grant below.
  7. Click Save.

The new role appears in the Store Roles list. It grants nothing until you assign it in the next procedure.

Assign the store role to a Salesforce user

Decide the scope before you start. Specific Store grants the role for that one store. If the user needs the role across several stores, create a store group containing only those stores and use Store Group instead. All Stores grants the role everywhere.

  1. On the Store Role record, go to the Store User Roles related list.
  2. Click New.
  3. Search for and select the Salesforce user.
  4. Ensure the correct Store Role is selected.
  5. Under Store Scope, choose:
    • All Stores
    • Store Group (then pick your store group)
    • Specific Store (then pick your store)
  6. Click Save.

The user now appears in the Store User Roles related list on the Store Role. Ask them to open the Store record and confirm the Website Builder or Web Console action is available to them.

What the API scopes grant

API Scopes on a Content Changes role apply when a user connects an AI agent or calls the website API. A user’s scopes on a store are the union of API Scopes across every role they hold for that store. A role with nothing selected grants nothing: there is no default bundle.

Scope What it allows
Accounts (Read), Accounts (Write) Reading and updating the accounts a checkout needs
Carts (Read), Carts (Write) Building a cart, without charging it
Catalog (Read), Catalog (Write) Reading and staging changes to products, variants, categories and traits
Checkout Charging a cart. Granted separately from building one
Contacts (Read), Contacts (Write) Reading and updating the contacts a checkout needs
Content (Read), Content (Write) Reading and staging changes to pages, articles, content blocks, menus and media
Extraction (Read) Crawling and capturing an existing website so an agent can rebuild it
Payment Methods (Read), Payment Methods (Write) Reading and saving a customer’s payment methods
Publish Own Changes Reserved for a future release. Selecting it has no effect today
Publish Staged Changes Submitting a staged change for review
Store (Read) Reading the store’s settings
Subscriptions (Read), Subscriptions (Write) Reading and changing a customer’s subscriptions
Themes (Read), Themes (Write) Reading and staging changes to themes, templates, assets and theme variables

The two installed roles carry the content group: Content, Catalog and Themes read and write, Publish Staged Changes, Store (Read) and Extraction (Read). The checkout scopes are kept separate on purpose, because a person trusted to edit content is not automatically trusted to charge a card.

Scopes decide what an agent may do. Whether a person can connect an agent at all is a separate switch, managed in the StoreConnect Console. See Manage who can use an AI agent.

An agent’s session is granted the scopes the user holds at sign-in and keeps them for the life of the session, about eight hours. After you change a role’s API Scopes, its level, or which stores a user’s assignment covers, ask the user to sign in again from their agent, with their existing token, so the change applies. They do not need a new token.

Related articles

Documentation Adding branding to a store Documentation Overview of store customization Documentation Set up basic styling with CSS Documentation Connect an AI agent to your store Documentation Manage who can use an AI agent Documentation Review and approve a Content Change

Was this article helpful?

Was this article helpful?