What data for this category looks like
Data covers content related to the full lifecycle of operation and maintenance assets. Four core documents are regularly produced: configuration item lists, service component relationship topologies, change records, and asset inventory tables. Data sources include self-built CMDB, cloud resource lists, automatic discovery tools, and procurement ledgers. Update frequency is daily or weekly. Data fields include asset unique identifiers, cross-component dependency relationships, change times, and operation responsible persons. No additional statistical percentages or fabricated values are included. The core focus is on the collection, verification, and update processes for configuration items.
What constraints these characteristics impose on permission and data isolation
Data sources are scattered and involve multi-system assets. Permission isolation must cover access control for all data entry points to avoid cross-system unauthorized access. Differences in update frequency require permission policies to adapt to real-time and periodic update scenarios. This prevents access anomalies caused by expired or unsynchronized permissions. Configuration item lists and relationship topologies include service dependency chains. Insufficient permissions will directly reduce fault location efficiency. Asset inventory tables and change records involve sensitive operation permissions. Strict role permission separation is required for configuration item collection, review, and change. Additionally, differences between this category and IT asset inventory categories require isolation rules to focus on dependency relationships rather than single assets. This avoids cross-category permission confusion.
How to configure
This document applies to FastGPT v4.17.0.
| Configuration Item | Recommended Approach | Rationale |
|---|---|---|
teamId | Divide by business team, use values ["ops-team", "sec-team", "audit-team"] | Data involves multi-business-line assets, requiring access permission isolation by team to match daily operation and maintenance role divisions |
tmbId | Divide by CMDB instance environment, use values ["cmdb-prod", "cmdb-test"] | Configuration items are split into production and test environments, requiring cross-environment access isolation by instance ID to prevent test data leakage |
| Data update permissions | Only allowed to be executed by change administrators, trigger frequency matches daily/weekly update tasks | Data update frequency is daily or weekly, requiring strict control of update operation permissions to prevent accidental modification of core configurations |
| Sensitive field desensitization | Desensitize asset responsible persons and procurement ledger information, retain the last 4 characters | Asset inventory tables and procurement ledgers contain sensitive information, requiring compliant isolation of unauthorized access |
| Access log retention | Retain for 90 days | Compliance review requires tracing permission operation records to meet security audit requirements |
Three common configuration errors
- Phenomenon: After configuring permission isolation rules, custom plugins in workflow tasks show no input or output parameters, and no error logs are generated. Reason: The plugin permission scope of the corresponding business team is not bound via
teamId, causing permission verification to intercept the parameter loading process. - Phenomenon: After local deployment is completed, multiple accounts cannot be created, and adding data to asset tables has no response. Reason: The CMDB instance group permission corresponding to
tmbIdis not configured, causing data writing to be blocked by the isolation policy. - Phenomenon: After configuring data isolation, connection to the SSO authentication system fails. Reason: The SSO authentication domain is not bound to the team permission scope, causing no corresponding data access permission after authentication passes.
How to confirm successful configuration
- Accounts from different business teams can only view configuration item lists within their corresponding
teamIdrange. - Only authorized roles can execute configuration item collection and change operations, which is verified by triggering data update tasks.
- SSO authentication requests can be submitted, and the account automatically matches the permission scope of the corresponding
tmbIdafter authentication is completed. - All permission operations are recorded and traceable, which is verified by viewing access logs.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.