---
title: "Give each person the smallest role in the · Agent Wranglers"
url: https://agentwranglers.se/playbook/payments/payment-events-and-reconciliation/provider-dashboard-access
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Give each person the smallest role in the provider dashboard

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

For AI agents: [llms.txt](https://agentwranglers.se/llms.txt) is a short guide that sends you to the rules your problem needs, and [rules.json](https://agentwranglers.se/playbook/payments/rules.json) holds every rule of this playbook as JSON.

- Level: Required
- Chapter: [Payment events and reconciliation](https://agentwranglers.se/playbook/payments/payment-events-and-reconciliation)
- Rule: Give every person their own login to the payment provider's dashboard, with two-step login and the smallest role that does their job. Alert on every change to payout bank details or team members.
- Risk: An account or system taken over
- Applies when: The project it takes payments.
- How: The dashboard can refund payments, create API keys and change the bank account that receives payouts. One stolen admin login can send your money elsewhere and invite more attackers. Providers offer narrow roles, such as Stripe's Refund Analyst, Dispute Analyst and View Only. Keep admin roles for two named people. Require two-step login for the whole account, and sign in through your identity provider where the dashboard allows it. Remove leavers on their last day. Include the dashboard in [Review access every quarter](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/access-reviews). Route the provider's security emails, such as a new bank account or a new team member, to a shared inbox that someone reads. Use the same identity setup as [Sign people in through single sign-on](https://agentwranglers.se/playbook/infrastructure/identity-and-access/single-sign-on-for-people).
- Check: The dashboard's team list matches the current staff list, and at most 2 people hold an admin role. The account setting requires two-step login. The provider's notification settings send bank account and team changes to the shared inbox.

## Sources

- [Stripe user roles](https://docs.stripe.com/get-started/account/teams/roles)

## Related rules

- [Review access every quarter](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/access-reviews) in Compliance
- [Sign people in through single sign-on](https://agentwranglers.se/playbook/infrastructure/identity-and-access/single-sign-on-for-people) in Infrastructure

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/payments/payment-events-and-reconciliation/provider-dashboard-access">Agent Wranglers payments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Alert when payments start failing](https://agentwranglers.se/playbook/payments/payment-events-and-reconciliation/payment-health-alerts)
- Next: [Pin the provider's API version](https://agentwranglers.se/playbook/payments/payment-events-and-reconciliation/provider-api-version)
- [Payment events and reconciliation](https://agentwranglers.se/playbook/payments/payment-events-and-reconciliation)