Plan B2B ordering rights separately from price access

Start B2B portal permissions with individual activities: viewing company prices, assembling requirements and submitting an order. The same person may do all of them. Signing in alone should not imply that these permissions are equivalent.

My recommendation is to decide explicitly on price access and ordering rights before introducing a broad “business customer” role. Otherwise, someone who only needs to cost a project may also gain access to submit orders.

One company account, different tasks

A fictional events business wants to buy exhibition-stand materials through a portal. Project planning should see the agreed prices and prepare a cart. Purchasing should review the requirements and submit the order. The following table describes the desired rule for this example, not a guaranteed standard feature of a shop product.

Project planning needs a clear handover route, such as a saved draft that authorised purchasing staff can open. Sharing a password does not replace that handover. Before submitting, purchasing must see the current selection and applicable prices.

The platform must support the required actions

Role names alone are insufficient for choosing a system. For example, Shopify describes two B2B customer roles with different scopes, both of which can place orders. That does not establish a price-viewing-only role for our example. Check the actual permissions and supported handover route in the intended system; any necessary extension belongs in the project scope.

The decision must also be enforced on the server. Removing an order button does not prevent a direct request. OWASP recommends permission checks on every request. A planned test must therefore also show that project planning cannot submit an order and, after company access is revoked, can no longer retrieve protected prices. An already-open page alone is no proof that permissions remain valid.

When a shared role is sufficient

If one person purchases for the customer business and is also allowed to check prices, assemble requirements and order, a shared role can fit. Additional coordination stages without an operational reason would make purchasing harder. The criterion is the actual division of work: establish that before choosing how to assign permissions.

Sources

• Shopify — Creating and managing B2B company contacts using customers

• OWASP — Authorization Cheat Sheet