What this category of data looks like
This category of data typically includes VPC planning documents, security group rule lists, load balancer configuration files, and operations change tickets. Data sources include configuration snapshots exported from cloud platform consoles, network topology diagrams, real-time traffic monitoring reports, and architecture design documents submitted by customers. Data updates are triggered upon completion of a single operations change or internal ticket. Each data entry corresponds to an independent network segment planning, access rule, or traffic forwarding configuration. It includes dedicated fields such as network segment mask, port range, listener protocol, and health check threshold.
What constraints do these characteristics impose on permission and data isolation?
The multi-source data and sensitive field attributes of this category require permission isolation to align with the resource access scope of different roles. Configuration data exported from cloud platform consoles is only visible to resources belonging to the corresponding team. Bind teamId to limit access boundaries. The update frequency of real-time traffic monitoring data requires permission configurations to take effect immediately. This prevents cross-departmental access to unauthorized traffic reports. Dedicated fields such as network segment mask and health check threshold are core sensitive information for operations. Split knowledge base permissions corresponding to tmbId by department or project. This prevents unauthorized personnel from viewing or modifying network configurations. Configuration data associated with internal tickets is only visible to on-call personnel participating in the ticket. Limit access permissions based on the ticket scope.
How to configure these settings
This document applies to FastGPT v4.17.0.
| Configuration Item | Recommended Approach | Rationale |
|---|---|---|
teamId | Bind the unique identifier of the team to which the cloud resource belongs | Limit the knowledge base to only associate cloud network configuration data for the corresponding team |
tmbId | Assign sub-team identifiers by department or project group | Split access permissions for different departments within the same team |
| Knowledge base permission scope | Divide by role: on-call engineers may only view configurations associated with their assigned tickets | Match the on-demand access requirements of operations on-call work |
| API call permissions | Assign temporary tokens with a validity period of 3600 seconds based on user roles | Prevent long-term exposure of API access permissions |
| Configuration query limit | Return no more than 20 configuration entries per single query | Avoid returning excessive sensitive information in a single request |
| Historical data retention | Only retain change tickets and configuration snapshots from the last 30 days | Control the scope of data storage |
Three common configuration errors
- A 403 permission denied error occurs when calling the API. The root cause is that the corresponding
teamIdis not bound in the knowledge base configuration. The system cannot identify the caller’s legitimate access scope. - Operations personnel from different departments can view each other’s load balancer configurations. The root cause is that sub-team permissions are not assigned using
tmbId, and departmental access boundaries within the same team are not separated. - After enabling team management functionality in a local deployment, the permission verification switch is not enabled. Unauthorized users can directly modify cloud network configurations. The root cause is that the effective configuration item for team permissions is omitted.
How to confirm that the configuration is properly set up
- Call the knowledge base API bound to
teamId. Use a token from an unauthorized team, and confirm that a permission denied error is returned. - Switch to sub-accounts corresponding to different
tmbIdvalues. Confirm that only cloud network configuration documents for the corresponding department are visible. - Check the validity period of the API token. Confirm that the generated token has an expiration duration of 3600 seconds.
- Log in to the local FastGPT backend. Confirm that the team management function is enabled and the configuration item corresponding to
teamIdis bound. - Execute a single configuration query. Confirm that the number of returned configuration entries does not exceed 20.
The values provided are common starting points and should be evaluated against the reader’s own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.