How do I stop regular staff from cancelling orders or issuing refunds?

Permissions are role-based. Give only managers the Cancel orders & issue refunds permission in Settings, so other staff cannot action it.