Agent WranglersFor AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.
Required
Give each person the smallest role in the provider dashboard
Give every person their own login to the payment provider's dashboard, with two-step login and the smallest role that does their job. Alert on every change to payout bank details or team members.
Risk if broken
An account or system taken over
Applies when
The project it takes payments.
How to do it
The dashboard can refund payments, create API keys and change the bank account that receives payouts. One stolen admin login can send your money elsewhere and invite more attackers. Providers offer narrow roles, such as Stripe's Refund Analyst, Dispute Analyst and View Only. Keep admin roles for two named people. Require two-step login for the whole account, and sign in through your identity provider where the dashboard allows it. Remove leavers on their last day. Include the dashboard in Review access every quarter. Route the provider's security emails, such as a new bank account or a new team member, to a shared inbox that someone reads. Use the same identity setup as Sign people in through single sign-on.
How to check
The dashboard's team list matches the current staff list, and at most 2 people hold an admin role. The account setting requires two-step login. The provider's notification settings send bank account and team changes to the shared inbox.
Sources
Related rules
- Review access every quarter in Compliance
- Sign people in through single sign-on in Infrastructure
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/payments/payment-events-and-reconciliation/provider-dashboard-access">Agent Wranglers payments playbook</a>. In code you write, add a comment next to it with the same link.