Permissions
Lyna gates Shopify access on three independent layers. A write action only runs when all three allow it:
- Project access, your role on the Lyna project.
- Owner-only write restriction, an optional toggle that limits store changes to the owner.
- AI tool permissions, what each Shopify tool is allowed to do (Always allow, Ask, or Never).
Who can read and who can write
Reading a connected store (listing products, collections, orders, and so on) and running write actions both require editor access to the Lyna project. Read-only collaborators see the connector but cannot make changes.
| Scenario | Read store data | Run write actions |
|---|---|---|
| Project owner / connecting user | Yes | Yes |
| Editor collaborator, owner-only write off (default) | Yes | Yes (subject to AI tool permissions) |
| Editor collaborator, owner-only write on | Yes | No, owner only |
| Read-only collaborator (viewer) | Yes | No |
Reads stay open to every collaborator with project access regardless of the owner-only setting. Only write and mutating actions are restricted.
Owner-only write restriction
In the connected Overview tab, the toggle "Only the store owner can manage this store" controls who may run store-changing actions.
- Off (default): any editor collaborator can run write actions, subject to the AI tool permissions below.
- On: only the store owner (the workspace owner or the user who connected the store) can run write actions. Other collaborators can still read store data.
This setting defaults off, so existing connections keep their shared-write behavior until someone turns it on. Only the workspace owner or the user who established the connection can change it (and only the project owner or connecting user can disconnect the store).
Workspace default
Set what Lyna can do with Shopify by default across every project in a workspace, under Settings > Connectors > Shopify (in the connected AI Tools tab and on the not-connected screen).
- Enable Shopify for new projects: new projects in the workspace start with the Shopify connector enabled.
- Default permission: the level (Always allow, Ask each time, or Never) that new or ungoverned projects inherit.
Only workspace owners and admins can change the workspace default. Individual projects can still override it.
AI tool permissions
Each project controls what Lyna's AI can do in the store. There are two global controls plus a per-tool matrix:
- Enable Shopify: the master toggle for the connector in this project. When off, Lyna's Shopify write tools are blocked.
- Manage all permissions: sets the default level for every write tool at once. Expand a group to fine-tune individual tools.
Every write tool can be set to one of three levels:
| Level | Behavior |
|---|---|
| Always allow | Lyna runs the action without asking. |
| Ask each time (default) | Lyna asks for your approval in chat before running the action. |
| Never | The action is blocked. Lyna receives a permission-denied result and will not retry. |
Read and discovery tools (listing or fetching data) are not individually gated and are available to any editor. The permission matrix governs the write and mutating tools listed below. Changing a project's permissions requires project admin access.
How a permission is resolved
When Lyna checks a write tool, it resolves the effective level in this order:
- An explicit per-project setting for that tool, if present.
- Otherwise, the workspace default.
- Otherwise, the built-in default (connector enabled, level Ask each time).
A workspace default can only narrow the built-in default (a workspace set to Never still blocks), and an explicit per-project setting always wins over the workspace default.
The write-tool matrix
These are the tools shown in the per-tool matrix. Every one defaults to Ask each time. The complete tool list, including read tools, is on the AI Tools page.
| Group | Tool | What it does |
|---|---|---|
| Products | Create product | Add new products with variants, images, and pricing. |
| Products | Update product | Edit a product's title, description, tags, status, or media. |
| Products | Delete product | Permanently remove a product. |
| Products | Add product image | Add an image from a URL, an upload, or an AI-generated image. |
| Variants | Add product variant | Add a variant such as a size or color. |
| Variants | Update product variant | Edit a variant's price, SKU, inventory, or options. |
| Variants | Delete product variant | Remove a variant from a product. |
| Collections | Create collection | Group products into a new collection. |
| Collections | Update collection | Edit a collection's title, description, or membership. |
| Collections | Delete collection | Remove a collection. |
| Discounts & pricing | Create discount code | Create a code with a percentage or fixed amount, dates, and limits. |
| Discounts & pricing | Update discount code | Edit a discount code's value, schedule, or limits. |
| Discounts & pricing | Delete discount code | Remove a discount code. |
| Discounts & pricing | Create price rule | Create a price rule that defines how a discount applies. |
| Discounts & pricing | Update price rule | Edit a price rule's conditions or value. |
| Discounts & pricing | Delete price rule | Remove a price rule. |
| Discounts & pricing | Create automatic discount | Create a discount that applies automatically at checkout. |
| Inventory | Set inventory | Adjust available inventory for a variant at a location. |
| Content & metadata | Set metafield | Create or update a metafield on a product, collection, or other resource. |
| Content & metadata | Create metaobject definition | Define a custom content type for structured content. |
| Content & metadata | Create metaobject | Add an entry of a custom content type. |
| Content & metadata | Upload file | Upload an image or file to the store's content library. |
| Orders & customers | Create draft order | Draft an order for a customer before it is finalized. |
| Orders & customers | Complete draft order | Turn a draft order into a real order. |
| Webhooks | Create webhook | Subscribe an endpoint to a webhook topic. |
| Webhooks | Delete webhook | Remove a webhook subscription. |
| Payments | Create checkout | Mint a cart and return a hosted checkout URL. |
| Sales channels | Publish product | Publish a product to a sales channel. |
| Sales channels | Publish all products | Publish every product to a sales channel in one step. |
| API access | Run Admin GraphQL mutation | Run a write operation against the Admin GraphQL API. |
| API access | Write with Admin REST | Send POST, PUT, PATCH, or DELETE to the Admin REST API. |
| Storefront & functions | Set storefront variables | Write the Storefront API environment variables into your app. |
| Storefront & functions | Scaffold storefront | Add the Storefront client plus starter product and cart routes. |
| Storefront & functions | Scaffold Shopify Function | Generate a Shopify Function extension for discounts, validation, or checkout logic. |