How do I stop regular staff from cancelling orders or issuing refunds?
Permissions are role-based.
Open Settings → General → Manage Organization → Roles & Permissions. Restrict Cancel orders & issue refunds to the appropriate non-admin roles. Admin always retains full access.