How much access should software have to wallets and payment credentials?