What this category of data looks like
Data for this category is generated during customer service cycles. Daily documents include SLA terms, monthly service reports, availability statistics, and customer review minutes. Data sources include internal monitoring systems, ticket systems, customer contracts, and communication records. Update frequency is monthly or quarterly. Documents are archived per customer contract cycle. Fields include contractually agreed service metrics, customer identifiers, incident lists, compensation-related records, and other content. There are no fixed unified statistical thresholds. Content is generated based on actual service conditions.
Constraints imposed by these characteristics on permissions and data isolation
This category of data is archived per customer contract cycle and includes customer sensitive information. Permission isolation must be precisely bound to individual customer service data to prevent cross-customer data leaks. Update frequency is monthly or quarterly, so real-time high-frequency permission checks are not required. Permission scopes must be synchronized after data generation according to the update cycle. Data sources include different types of content from multiple systems, so unified permission control rules are needed. This ensures users in different positions can only access documents within their job responsibilities. Data errors can lead to compensation disputes, customer complaints, and other consequences. Permission operations must be traceable, and access permissions for sensitive fields must be strictly restricted.
How to configure settings
This configuration applies to FastGPT v4.17.0.
| Configuration Item | Recommended Approach | Rationale |
|---|---|---|
teamId | Bind to the exclusive teamId of the corresponding customer, only allow users with the same teamId to access | SLA and service reports are archived by customer contract, teamId enables precise data isolation to prevent cross-customer data leaks |
tmbId | Associate with the tmbId of the corresponding SLA template, only allow template creators and authorized users to edit | SLA terms vary between different customers, isolate templates and generated report data by tmbId to ensure the correspondence between templates and reports |
| User permission level | Divided into three levels: view, edit, manage. Customer success managers are assigned view permissions, technical support supervisors are assigned edit permissions | Business positions include customer success managers, service managers and other roles, permissions must match job responsibilities to prevent unauthorized operations |
| Permission change audit | Enable full operation log retention, retention duration is determined based on actual testing | Data errors can lead to compensation disputes and customer complaints, all permission operation records must be traceable to meet compliance review requirements |
| Cross-team data access | Disabled by default, manually enabled only in special scenarios | SLA and service reports involve customer sensitive information, cross-team access easily leads to compliance risks, disabling by default reduces the probability of leaks |
Three common configuration errors
- Symptom: Only the root account can access all SLA and service report data, regular accounts cannot log in or have no access permissions. Cause: The regular user account creation and permission allocation configuration was not completed, and the team permission function was not enabled.
- Symptom: Generated service reports contain sensitive data from other customers. Cause: Data was not isolated by
teamId, resulting in mixed display of service data from different customers. - Symptom: An "insufficient permissions" error appears after configuring permissions. Cause: The corresponding template data was not associated by
tmbId, resulting in users being unable to access the specified SLA template and reports.
How to verify the configuration is complete
- Log in with a regular user account, try to access SLA data that does not belong to their
teamId, and confirm that normal access is not possible. - View the permission audit log, and confirm that all permission operations have complete retained records.
- Switch to a regular account corresponding to a specific job position, and confirm that document content matching the job responsibilities is accessible.
- Try to edit an SLA template with an unauthorized
tmbId, and confirm that the system blocks the operation.
The values listed here are common starting points and should be evaluated against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.