Separate the jobs you need done

List the actions involved in a purchase: requesting, approving, entering payment details, releasing funds and reconciling the result. Decide which people should perform each action and ask the provider which permissions it supports. A small team may combine roles, but that should be a conscious decision with a documented review process. Do not let the first account owner's unrestricted access become the permanent model simply because onboarding was easier that way.

Test permissions with ordinary scenarios

Walk through a new supplier, an urgent purchase and an employee departure. Check whether authorised people can do their work without sharing logins or asking colleagues to expose payment credentials. Record which actions require a second approval and how emergency exceptions are reviewed. The right permission model is practical enough for daily work and clear enough for a new finance colleague to understand without reconstructing several months of informal decisions made across chats and meetings.

Imagine this

Hypothetical example

A hypothetical creative agency gives project leads authority to request purchases while finance approves supplier changes. During a provider trial, the team checks whether the permissions support that split. The exercise reveals a missing role before the agency moves its main purchasing workflow into the platform.

Make it practical.

Use this checklist as you read. Checks are not stored.

References & further reading

Background reading — PCI Security Standards Council: merchant resources ↗

Published by Tap Tap Go. Product availability and eligibility vary by programme and market. About our stories.