This ticket lays out how permissions should work for multi-shop so we need to double-check these have not changed.