Permissions and Data Isolation for College Admissions Health Examination Organization: Compare Documents and Locate Differences

Admissions Health Exams: review permissions for document checks. Check source versions, input mappings and the values received by downstream nodes.

What this category's data looks like

This page is intended for university admissions physical examination organization. Materials come from three types of paper or scanned documents: physical examination forms, re-examination applications, and restricted-major notifications. They enter the system in batches according to admissions batches, and each batch contains fields such as name, ID number, physical examination conclusion, restricted major code, signature, and receipt date. The physical examination form carries the basic conclusion and the chief examiner's signature, the re-examination application carries the review items and application date, and the restricted-major notification records the notification time and the candidate's acknowledgment. After entering this function, the three types of materials are each mounted as independent files, and members obtain file read permissions according to their scope of responsibility, forming a verifiable file set used to compare whether the name, quantity, and date of the same object are consistent across two materials, and to locate discrepancy fields.

Configuration and implementation checks

Enable commercial file permissions and give the member read access to the knowledge base.

This step is executed by member permissions and file-level permissions (server-side authentication), and outputs the visible file set filtered by member. The "discrepancy list" is completed subsequently by AI nodes, code nodes, or manual work; the file list and retrieval only return the readable set filtered by member. Team administrators do not bypass file-level permissions, and unauthorized files do not occupy a place and are not recalled.

ObjectCheckVerification action
Physical examination formWhether the name, restricted major code, and date of the same candidate are consistent between the physical examination form and the restricted-major notification, and whether the chief examiner's signature and receipt are completeOpen the details of both files with a member account, compare field by field, and record discrepancy fields
Re-examination applicationWhether the number of re-examination items and the application date match between the re-examination application and the physical examination form conclusion, and whether signatures or receipts are missingLocate the member's visible scope by teamId and tmbId, and check the quantity and date fields of the two materials
Restricted-major notificationWhether the notification time and the candidate's acknowledgment date are consistent with the ledger, and whether the version is synchronizedSearch the same candidate's keyword, check the recalled files and ledger fields, and mark items whose versions are not synchronized
File list and retrievalRestricted members can only see authorized files, and retrieval does not recall unauthorized filesView the list and perform one retrieval with a restricted account, and check the visible scope and recall results

Three common errors

  • Symptom: the restricted major code of the same candidate does not match between the physical examination form and the restricted-major notification. Cause: the two materials were entered separately, versions were not synchronized, and the ledger was not written back after updating.
  • Symptom: the number of re-examination items and the application date are inconsistent between the re-examination application and the physical examination form conclusion. Cause: materials enter in batches, and fields were not merged and checked against the same object.
  • Symptom: a restricted member saw a physical examination form they should not see, and retrieval recalled unauthorized files. Cause: file-level permissions were not filtered item by item by member, or the authentication method was not executed according to member identity.

How to verify the setup

Acceptance of this function: use a restricted account to view the file list and perform one retrieval, and check that the visible scope contains only authorized files, and that unauthorized files do not occupy a place and are not recalled.

Business test: use one real record to find a field inconsistent with the ledger, record the name, quantity, or date discrepancy, and submit it to the reviewer for confirmation and write-back.

  • Check file read permissions: use a member account to view the list and details, confirm that only files readable by that member are returned, and record the scope corresponding to tmbId.
  • Check delete permissions: use a collaborator account to try deleting a file not created by them; it should be filtered and prompted, confirming that deletion is limited to the creator.