Authorization
Validate tenant membership and role before exposing stores, jobs or approvals.
Direct answer
A transparent overview of theme permissions, token protection, tenant scoping and operational boundaries.
Security and access boundaries for TaskerArmy
This page explains the security model for a theme-focused Shopify engineering product. It distinguishes confirmed product architecture from items that must be verified against production configuration, contracts and operating policy before being treated as formal guarantees.
Data handled
The product is designed around theme engineering context
TaskerArmy should request only the data and Shopify permissions required for current product behavior. Theme engineering does not inherently require unrestricted access to customer or order records.
The definitive statement about permissions is the production Shopify app configuration. Marketing copy, documentation and the Partner Dashboard must remain aligned.
| Data category | Purpose | Boundary |
|---|---|---|
| Account and team data | Authenticate users and associate them with a merchant tenant | Access should follow tenant membership and role |
| Shopify store connection | Identify the connected shop and authorized integration | Tokens and scopes must match the installed app configuration |
| Theme files and metadata | Inspect, plan, prepare and validate theme work | Jobs must target the correct store and theme |
| Engineering job records | Track requests, changesets, QA, approvals and Engineering Runs | Records remain attributable to the tenant and job |
| Operational logs | Investigate failures, security events and deployment state | Retention and access should follow documented policy |
| Support communications | Resolve product and account issues | Do not request secrets or unrelated customer data through support |
Shopify permissions
Theme access is scoped by store, tenant and workflow state
Connection controls
- Shopify OAuth establishes the store connection.
- The connected shop is associated with the correct TaskerArmy tenant.
- Theme targets are identified before reads or writes occur.
- Uninstalling or revoking the app should prevent future authorized API access.
Execution controls
- Agent-generated theme writes target staging by default.
- Production deployment requires an explicit merchant-approved decision.
- The changeset records the files and target involved.
- Exceptional actions should be restricted and attributable.
Tenant isolation
One merchant’s context must not become another merchant’s context
Every job should carry tenant, store and user identity through planning, tool calls, changesets, approvals and deployment records. A store identifier supplied by a request should be validated against the authenticated tenant rather than trusted directly.
Background jobs and AI tool calls require the same isolation as interactive requests. The absence of a visible browser session does not relax the tenant boundary.
Tool context
Pass the resolved tenant and store context into every theme read or write operation.
Storage
Associate changesets, logs and Engineering Run records with the owning tenant.
Testing
Include negative tests proving that cross-tenant identifiers are rejected.
Secrets and tokens
Credentials should be encrypted, access-limited and revocable
- Do not expose Shopify access tokens to browser code, logs or AI prompts.
- Encrypt secrets at rest using the production platform’s supported secret-management controls.
- Limit token access to the services that perform authorized Shopify operations.
- Redact secrets and sensitive headers from error reporting and support output.
- Rotate or invalidate credentials after suspected exposure.
- Treat theme files as untrusted reference data; embedded comments must not override platform or merchant instructions.
Logging and retention
Operational evidence should be useful without becoming uncontrolled data collection
Exact retention periods should be published only after they are verified in the privacy policy, contracts and production configuration. This page should not invent a fixed period that operations do not enforce.
| Record | Security purpose | Governance requirement |
|---|---|---|
| Authentication and membership events | Investigate unauthorized access | Define retention and restricted access |
| Theme read/write attempts | Reconstruct what operation targeted which store and theme | Avoid storing unnecessary full-file content in general logs |
| Changesets and approvals | Prove what was reviewed and who authorized it | Tie records to the exact artifact version |
| Errors and reconciliation states | Recover from partial or ambiguous operations | Redact tokens and customer information |
| Support activity | Track account assistance and security reports | Follow the privacy policy and access controls |
Operations
Subprocessors, revocation and incident response
Provider governance
- Maintain a current list of hosting, authentication, communications, billing and observability providers where applicable.
- Describe why each provider receives data and the applicable region or transfer basis.
- Keep internal infrastructure providers out of the public integrations catalogue unless they are customer-facing integrations.
Revocation and response
- Provide a clear path to disconnect a store or remove a team member.
- Stop future authorized operations after app uninstall or credential revocation.
- Preserve enough evidence to investigate a suspected incident.
- Publish a security contact and explain what information reporters should provide.
- Notify affected parties according to applicable law and contractual obligations.
Diligence status
What can be stated now and what requires formal verification
| Area | Current public position |
|---|---|
| staging-based agent writes | Supported as the current product workflow for agent-prepared theme changes |
| Explicit merchant production decision | Supported as the intended authority boundary |
| Tenant-scoped store access | Core architectural requirement and subject to continuous negative testing |
| Exact Shopify scopes | Must be verified against the live Partner Dashboard configuration |
| Retention periods | Must match the privacy policy and production enforcement |
| Security certifications | Do not claim certifications unless current evidence exists |
| Penetration testing and formal audit reports | Publish only when completed and distributable |
| DPA and enterprise contractual commitments | Require legal and operational review before final publication |
Secure development
Security also depends on how changes to TaskerArmy are built and reviewed
Engineering controls
- Code changes receive review and automated checks before production.
- Secrets are not committed to the repository.
- Dependencies and platform runtimes are updated deliberately.
- Authorization and tenant-isolation paths have negative tests.
- Production configuration changes are attributable and reversible where possible.
Operational controls
- Administrative access follows least privilege.
- Security-sensitive events are logged and reviewed.
- Backups and recovery expectations are documented for critical records.
- Incident contacts and escalation ownership are maintained.
- Public claims are updated when architecture or providers change.
Procurement questions
Information an enterprise review may request
Not every item is necessarily available in a self-serve plan. Enterprise commitments should be scoped through sales and legal review rather than implied by generic website language.
- Current Shopify scopes and installation consent screen.
- Hosting regions and current subprocessor list.
- Data retention and deletion procedures.
- Access-control and employee offboarding practices.
- Incident-response and notification process.
- Backup, recovery and service-continuity expectations.
- Available DPA, security addendum and contractual commitments.
- Independent test or certification evidence when it exists.
Scope
A public security overview, not an unsupported certification claim.
This page documents current product boundaries and operating controls. TaskerArmy should not imply SOC 2, ISO 27001 or another certification until it has been completed and can be evidenced.
Shopify access
Permissions must match theme engineering.
OAuth scopes, app listing text, privacy disclosures and the actual code configuration must remain synchronized. Unnecessary customer and order scopes should not be requested.
Tenant isolation
Every store and job is scoped to an authorized tenant.
Authorization checks should be enforced server-side for stores, themes, jobs, files, previews, billing and MCP context.
Secret handling
Tokens and secrets stay outside logs and generated output.
Use protected environment configuration, encrypted storage where applicable, least-privilege service access and explicit rotation or revocation procedures.
Operational controls
Approval, activity history and support access remain attributable.
Administrative support access should be logged. Impersonation or troubleshooting tools must show actor, tenant, purpose and time.
Subprocessors
Internal infrastructure belongs in a subprocessor or privacy disclosure, not the integrations marketplace.
Email, billing, hosting, database and model providers should be listed where legally and operationally relevant without presenting them as customer-configurable product integrations.
Incident reporting
Make suspected incidents easy to report without sharing secrets.
Provide a monitored security contact, acknowledge reports, preserve evidence and communicate confirmed impact and remediation with appropriate customers.
Continuity
Backups, deployment controls and recovery procedures support resilience.
The marketing site and product require separate availability, recovery and incident procedures. Public status reporting should move to a monitored status service.
Continue exploring
Related TaskerArmy pages
Questions
Direct answers before installation
Does TaskerArmy edit the live theme automatically?
No. TaskerArmy prepares changes in a staging theme. Your team reviews the preview and decides whether anything should be published.
Does TaskerArmy access customer or order data?
The product is designed around theme engineering. Current permissions should be verified against the live Shopify app configuration, and unnecessary customer or order scopes should not be requested.
What happens when the work is too complex?
TaskerArmy pauses and asks for more context, or routes the work to an experienced Shopify team when it does not fit the product.
Next step
Connect the store. Start with evidence.
Connect your store, review the audit and choose the first change you want TaskerArmy to prepare in staging.