Operations

Team Access Control

The assignment of platform and environment permissions by role, so each operator reaches only the stores and functions they need.

Aliases: Role-based access, sub-account permissions, 团队权限, 子账号管理

Two permission surfaces

A multi-store operation has two places where access is granted, and they are usually managed by different people.

The platform surface is the seller account itself: user accounts, role templates, and permissions per module such as advertising, inventory, payments and case management. Amazon structures this as user permissions with global and per-marketplace templates; TikTok Shop and other platforms offer comparable sub-account models.

The environment surface is the browser and infrastructure layer: which store profiles a person can open, which proxy each profile uses, and what activity is logged. Products such as Feikua Browser expose profile assignment and access logs inside the permission model, which is where this surface becomes auditable. This is where environment isolation becomes an operational control rather than a technical setting.

Why the split matters

Granting access in one surface and not the other creates gaps. An operator with platform permission but no assigned profile cannot work; an operator with a profile but no platform user is an unlogged shared login. The common failure is shared credentials circulated by message, which removes attribution entirely.

A role model that holds up

Owner. Entity-level rights, payout changes, user management. One or two people, documented.
Manager. Full store operations except payout and user management, multiple stores allowed.
Operator. Assigned stores only, catalogue and case work, no advertising budget changes.
Analyst. Read-only reporting, no publishing rights.
External. Time-boxed access for agencies, with an expiry date set at creation.

Each role maps to both surfaces: a permission template on the platform and an assigned profile set in the browser environment.

Lifecycle discipline

Access control fails at the edges: onboarding and departure. A leaver whose platform user remains active and whose profile stays assigned is the most common audit finding. The control is a join-and-leave checklist with a named owner, plus a quarterly reconciliation between the HR list, the platform user list and the profile assignment list.

What logs give you

Profile activity logs answer who opened which store and when. Platform logs answer what changed. Together they support an appeal after an enforcement action, because they show that an action was taken by a specific person in a specific environment rather than by the store owner.

Adjacent concepts

Access control is part of the structure described in multi-store management, supports account association risk management by preventing shared logins, and is a prerequisite for a clean store migration.

Primary source: Platform user permission documentation; vendor documentation for team features.

FAQ

Why not share one login across the team?

Shared logins remove attribution and defeat both platform and environment separation. An action cannot be traced to a person, and every user inherits the full permission set.

What should an operator role include?

The stores assigned to them, catalogue and case functions, and read access to reporting. Advertising budget changes and payout edits normally sit with a manager or owner.

How often should access be reviewed?

Quarterly, plus immediately on departure or role change. The review compares the staff list, platform users and profile assignments.

Do activity logs help in appeals?

They can. Logs showing which person opened which environment support the argument that an action was not taken by the account owner, and they document the controls in place.

How should agency access be handled?

Time-boxed, scoped to specific stores, with an expiry date and a named internal sponsor. Revoke at the end of the engagement and confirm the revocation in writing.