Data Profile
Core data for this category originates from employee contact lists, email gateways, internal training platforms, and user click statistics systems. Daily produced documents fall into four categories: training courseware, phishing drill plans, phishing email templates, and drill result reports. Data update frequency is typically quarterly or annually. Some single-event drill result reports require updates aligned with activity cycles. Document fields include drill audience scope, template variables, click conversion rates, compliance check tags, and other fields. No unified fixed units exist, and values adjust based on document type.
Constraints on Permission and Data Isolation
The data characteristics of this category impose multiple constraints on permission and data isolation. Employee contact list data involves personal privacy, so the teamId parameter must be used to bind team boundaries. This ensures different teams can only access their own team’s personnel information and prevents cross-team data leaks. Phishing email templates and drill plans are sensitive security materials. Exclusive content from different service providers or internal training teams must be isolated to prevent unauthorized calls. Drill result reports include compliance check results, and must be bound to permissions for the corresponding drill activity. This ensures only personnel participating in post-drill reviews can view the reports. Low update frequencies require stable permission configurations to avoid data access exceptions caused by configuration changes.
Configuration Guidelines
This configuration guide applies to FastGPT v4.17.0.
| Configuration Item | Recommended Approach | Rationale |
|---|---|---|
teamId | Bind the unique identifier of the team to which the current workflow belongs | Isolate drill data, training courseware, and drill reports across different teams to prevent cross-team access |
tmbId | Bind the unique identifier of the team to which the phishing email template belongs | Isolate exclusive templates of different service providers or internal training teams to prevent unauthorized calls |
| Global variable isolation rules | Isolate identical-named variables by user ID. Set variable cache duration to 5 minutes, adjusted based on actual testing | Ensure identical-named global variables from different users do not interfere with each other, matching actual business scenarios |
| Team data storage quota | Limit to within 10 GB, adjusted based on team size | Adapt to storage needs for drill data across different teams and avoid resource waste |
| Permission check timeout period | Set to 20–40 seconds, adjusted based on actual testing | Respond quickly to permission check requests and avoid impacting the execution flow of phishing drills |
| Sensitive document access log retention period | Set to 180 days | Meet log retention requirements for compliance audits and facilitate subsequent retrospective checks |
Three Common Configuration Errors
- The symptom is that different users obtain unintended values when calling identical-named global variables. The cause is that the global variable isolation rule based on user ID is not configured, leading to variable scopes not being divided by user.
- The symptom is that an attempt to access another team’s phishing email template returns "No permission to operate this conversation record". The cause is that the
teamIdparameter is not bound, resulting in incorrect matching of team boundaries during permission checks, and the system cannot identify the user’s affiliated team. - The symptom is that audit logs for drill result reports are missing. The cause is that the retention rule for sensitive document access logs is not configured, resulting in no valid retrospective evidence for compliance checks.
How to Verify Correct Configuration
- Initiate a cross-team phishing template access request. Confirm that a permission check failure prompt is returned to verify that the isolation configuration bound to
teamIdandtmbIdtakes effect. - Create identical-named global variables. Initiate calls using different user IDs, confirm that each user obtains independent variable values to verify that the global variable isolation rule is configured correctly.
- View the team data storage directory. Confirm that only the current team’s drill data and documents are present to verify that the team data storage quota configuration takes effect.
- Trigger multiple permission check requests. Confirm that response times meet business requirements to verify that the permission check timeout period is configured appropriately.
The values provided are common starting points and should be evaluated against local deployment samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.