Set merchant permissions