Currently, every admin user with the permission to edit an order (order.editor) can issue refunds of PayPal payments. It would be very helpful to add more granular permissions so that employees can modify orders but cannot issue refunds.