Shopify Flow has tightened its security model by tying workflow actions to the staff permissions you set in the Shopify admin. Previously, granting a single Flow app permission let any staff member run, test, or edit automations without further checks. Now, each step in a workflow must align with the individual’s existing admin rights, adding an extra layer of control and accountability.
What’s Changed in Shopify Flow?
Flow now uses the "Flow automations" permissions ("View, create, and delete automations" and "Manage connections and secrets") found under Settings > Users > Roles. In addition, when a staff member tries to test or turn on a workflow, Flow checks whether that staff member already has the admin permissions required for every action in the workflow. If a permission is missing, the workflow can be edited and saved as a draft, but it cannot be tested, activated, or manually run.
Who Is Affected?
How Permissions Work Now
When a workflow includes an "Add customer tags" step, the staff member must have the "Edit customers" permission. If the workflow uses a custom app connection, the staff member also needs the "Manage connections and secrets" permission. Flow surfaces a clear error message explaining which permission is missing, preventing accidental data exposure or unauthorized changes.
Action Steps for Store Owners
Action Steps for Developers
Sample Role Configuration (JSON)
{
"role": "Automation Manager",
"permissions": [
"flow_automations_view_create_delete",
"flow_manage_connections_and_secrets",
"customers_edit",
"orders_edit",
"products_edit"
]
}
Conclusion & Next Steps
The new permission checks give you tighter control over who can execute powerful automations, protecting both data and operational integrity. Take a few minutes today to audit your staff roles, adjust permissions where needed, and test your key workflows with the appropriate accounts. Need help updating roles or troubleshooting a workflow? Reach out in the Shopify Community or drop us a comment below!
