Sidekick-generated apps need owner-signed store permissions

Choose a small store job and name the data it can touch

A reorder suggestion, a customer-search helper, a discount tool, and a task tracker have different consequences. Before the owner gives anyone development permission, write one business job, the current manual process, the records the app needs to read, the records it may change, the reviewer, and a condition under which it must stop. A generated app working only inside the Shopify admin is not isolated from the customer experience: a changed product, discount, or content record can become customer-facing. Conversely, the guide does not say generated apps run in the theme or checkout. Keep the promised functionality inside Shopify's stated boundary.

Make the permission request concrete. If a store assistant needs to review sales velocity to recommend a reorder, ask why it would need customer or discount access at all. If it creates discount links, define owner-approved margin, expiry, eligible products, and who may release the offer. A useful prompt is not a policy; the installed app's permissions and observed behavior are the decision record.

Separate development rights from operating approval

Shopify says staff need App development > Develop to generate or edit, and the app is shared at store level. The owner should maintain a list of who has that permission, who can install the resulting version, and who checks any write it makes to store data. Use test products, sample orders, or non-sensitive records first where the available account permits it. Compare the generated app's behavior with expected results, including empty inventory, returns, duplicate customers, price overrides, expired discounts, and access denied. Have someone other than the requester inspect the requested scopes and customer-facing effect before the app is installed for ordinary work.

For every edit after installation, preserve the previous version, owner approval, changed permissions, test result, installation time, and person responsible for checking downstream data. Shopify describes versions and restoration inside its editor, but a code restore does not by itself undo an erroneous discount or customer record. Decide how the store would detect and correct that separately.

Measure a reversible operating win

For one narrow job, compare the same accepted work unit before and after: manual time, number of correct outputs, reviewer time, corrections, customer contacts, margin effects, and failed or blocked actions. Avoid treating number of generated apps, prompt speed, or a polished preview as proof of saved cash or improved sales. Include any subscription, staff time, third-party app, or support cost in the owner's choice, and verify current plan eligibility rather than assuming a marketing screenshot means availability in the store.

Keep an owner-controlled exit. The source says a merchant can review permissions and uninstall a generated app; separately preserve the records it touched, outstanding discount links, and a manual path for the job. If the app behaves unexpectedly, the owner needs to know who can suspend it, repair changed data, inform an affected customer, and restore the previous process. Reassess when a staff role, app version, store plan, API access, customer-data need, or sales workflow changes.

Turn this source into a reviewable decision

For AI for Business Owners, use this briefing as a dated decision record rather than a substitute for the source. Preserve Shopify Help Center, Generating apps with Sidekick, the exact URL, the September 22, 2026 review date, the supported facts above, the editorial interpretation, the limitations, and any buyer-specific evidence. Link that record to the decisions most directly affected: Scheduling and daily operations; Customer service and appointment support; Security, privacy, and vendor risk; Bookkeeping preparation and cash visibility. State whether the source changes the scope, evidence requirement, control, sequence, or only the language used to describe the decision.

Before action, name the accountable owner, affected population and workflow, exact offering or configuration, source data and rights, human decision point, exception and appeal path, complete cost, expected benefit, failure and stop conditions, retained evidence, and next review date. Keep official facts, provider statements, buyer observations, representative tests, measured outcomes, editorial inferences, and unknowns visibly separate. Reopen the record when the source, offer, model, integration, data, policy, population, responsible person, or measured result changes.

Limitations and unknowns

Shopify's current official help article, reviewed September 22, 2026, describes product capabilities, plan conditions, admin-only boundaries, and a stated permission and uninstall path. It has no attributable post-September 21 change time. It does not establish a particular store's plan, staff roles, data entitlements, generated code, granted scopes, safe test environment, pricing, accessibility, support, customer outcome, or reversibility of an already changed record. The publication did not install or operate a Sidekick-generated app. Obtain the actual store's access and version history, permissions, representative test and rollback evidence, current commercial terms, and appropriate privacy, legal, and security review before owner approval.