Security and Compliance Material Review for Ad Creative Audit: Permissions and Data Isolation

The core data for this category includes ad creatives, landing page screenshots, audit opinions, and modification records. Data sources include ad

Data Characteristics of This Category

The core data for this category includes ad creatives, landing page screenshots, audit opinions, and modification records. Data sources include ad delivery platforms, landing page hosting services, product qualification file libraries, and ad compliance clause libraries. Update frequency is daily or real-time synchronization. Single creative data contains a unique creative identifier, delivery channel tag, landing page verification result, and violation point annotation field. Audit opinions and modification records are stored associated by creative ID. Fields have no unified fixed units, and are generated dynamically alongside audit workflows.

Constraints on Permissions and Data Isolation

Data sources for ad creative audit cover multiple third-party platforms and compliance libraries. Real-time or high-frequency updated creatives require permission configurations to take effect synchronously, to prevent unauthorized cross-team access to materials. Single creative is associated with audit opinions and modification records. Data must be isolated by advertiser, agency, or audit group to prevent leakage of different customers' audit information. Operation scopes for different roles, such as ad auditors and brand compliance specialists, must be bound to corresponding creative pools. This prevents unauthorized viewing or modification of materials and audit records outside job responsibilities. Publicly accessible audit links must be bound to corresponding team permissions, to prevent unauthorized users from accessing sensitive ad compliance data.

How to Configure

This configuration applies to FastGPT v4.17.0.

Configuration ItemRecommended SettingRationale
Team Permission BindingBind teamId to advertiser groupsImplement data isolation for different advertisers
Member Access ScopeLimit to the creative pool corresponding to teamId, load no more than the first 100 entries per requestPrevent unauthorized cross-advertiser access to materials, control single-page load volume
Audit Group Permission AllocationAssign audit group operation permissions by tmbIdDistinguish responsibility boundaries between different audit teams
Chat Record IsolationEnable team-level session isolation configurationAvoid leakage of cross-team audit communication information
Data Storage IsolationDivide independent storage directories by teamId, per-team quota is 1000 MBMeet compliance requirements for multi-team data isolation, control per-team storage usage
Access Timeout Threshold600 secondsAdapt to response time requirements for real-time creative verification

Three Common Configuration Mistakes

  • Phenomenon: When adding team members, entering an account displays an invalid username. Cause: The member is not bound to the corresponding teamId group, or the account is not added to the platform's global user pool.
  • Phenomenon: After generating a publicly accessible link, any user can view audit records from all teams. Cause: Team-level data isolation configuration is not enabled, and teamId filtering of access scope is not applied.
  • Phenomenon: Modification records are not synchronized to the corresponding team after audit operations. Cause: The operation context is not associated with tmbId, resulting in data being written to the wrong group.

How to Verify Successful Configuration

  • Use an account not bound to teamId to log in, and verify that specified advertiser material data cannot be accessed.
  • Send an audit link to an unauthorized team member, and verify that the audit page for the corresponding material cannot be opened.
  • Check storage directories, and confirm that material data for different teamId values is stored in independent paths, with no cross-team data mixing.
  • Test adding a team member, enter a correct account, and confirm that a valid username is displayed with no error prompts.

The values provided are common starting points and should be evaluated against local deployment samples.

Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.