What This Category of Data Looks Like
Data for this category primarily comes from Git repositories, CI pipelines, static scanning reports, and defect databases. Daily generated documents include merge requests, code review comments, commit records, and branch strategy descriptions. Data fields include merge request IDs, reviewer lists, changed file scopes, CI build statuses, defect association tags, and more. This data updates daily or per commit, with real-time synchronization alongside code changes. Merge requests and review data from different teams are independent. Some CI scanning results include undisclosed defect details, which count as internal sensitive team information. Judging the impact of changes to this type of data usually requires combining business semantics, so permission isolation needs to cover multi-dimensional access restrictions.
What Constraints Do These Characteristics Impose on the "Permission and Data Isolation" Link
Since data sources are tied to the team permission system of Git repositories, permission configuration must align with Git team dimensions to prevent cross-team data leaks. The high-frequency update characteristic of this data means permission rules must be synchronized in real time or near real time, and cannot rely on static offline configurations. Merge requests and review records are associated with specific business change scopes, so visible content must be restricted by role. For example, interns may only view publicly available merge requests, and cannot access sensitive changes that have not been reviewed. Defect databases and static scanning reports contain unresolved technical details, so access permissions for unauthorized members must be blocked to prevent internal information from spreading. Internal ticket Q&A for operations on-call scenarios needs to limit access scope to avoid sensitive R&D data being accessed by unrelated teams or members.
How to Configure Settings
| Configuration Item | Recommended Approach | Rationale |
|---|---|---|
| Team Permission Binding | Associate with Git teams via teamId | Matches the Git repository permission system that this category of data originates from, and is compatible with FastGPT v4.17.0 |
| Member Role Configuration | Divided into three categories: reviewers, maintainers, read-only visitors | Corresponds to merge request review, merge, and view business scenarios |
| Permission Synchronization Cycle | Every 10 minutes | Matches the high-frequency update frequency of this category of data (daily or per commit) |
| Data Scope Filtering | Only return merge requests within the last 7 days associated with the current tmbId | Limits the team data access boundary for operations on-call scenarios |
| Sensitive Field Masking | Hide unauthorized static scanning reports larger than 100 KB | Corresponds to the internal sensitive defect information included in this category of data |
| Access Permission Validation | Bind to member roles of Git teams | Matches the team collaboration rules for code review and merge management |
Three Common Misconfigurations
- Symptom: Non-team members receive a 403 status code when attempting to access merge request data. Cause: The mapping relationship between
teamIdand Git teams was not configured, leading to failed permission validation. - Symptom: Intern accounts can view merge request CI reports for all teams. Cause: Data scope filtering was not enabled, and the team access permissions corresponding to
tmbIdwere not bound. - Symptom: Team members cannot create internal tickets associated with merge requests. Cause: The write permission for the corresponding
teamIdwas not assigned to members, and only read-only access permissions were configured.
How to Confirm Proper Configuration
- Access the system using an intern account, and check if only merge request documents within the assigned scope are displayed.
- Check the permission synchronization logs to confirm that Git team data associated with
teamIdis automatically synchronized per the set cycle. - Attempt to create an internal ticket associated with a merge request from a different team, and confirm that the operation is rejected by the system.
- View the content of CI static scanning reports, and confirm that sensitive fields for unauthorized users have been masked.
The values provided here are common starting points and should be evaluated against your own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.