What this category's data looks like
Daily data for image annotation projects includes four core document types: annotation specifications, bounding box examples, quality inspection reports, and rework lists. Data comes from image samples, category dictionaries, and spot-check results generated by annotation platforms. Data updates run on a daily cycle or trigger per annotation batch. Single-batch data includes fields such as visual target bounding box coordinates, category labels, and spot-check markers. There is no unified text content length limit. Data volume is distinguished only by image sample resolution and count. Core users include annotation teams, computer vision algorithm teams, and quality inspectors. Daily operations focus on target bounding box definition, occluded sample judgment, and rework communication.
What constraints do these features impose on permission and data isolation?
Visual samples from image annotation projects are sensitive business data. The tmbId and teamId fields bound to each batch must be strictly linked to permissions to prevent cross-team access. The high-frequency data update feature requires permission configurations to support dynamic adjustment of team members, to adapt to daily new annotation batches and personnel changes. There are clear role-based access differences for daily documents. Annotators, quality inspectors, and algorithm teams must have their access ranges limited separately. For example, quality inspectors can only view quality inspection reports and rework lists for their assigned batches, and cannot directly modify annotation specifications. Permission verification for image annotation data must be tied to the associated fields of visual samples. This differs from the metadata verification logic used for general text annotations, which further increases the complexity of isolation configurations.
How to configure settings
This configuration is based on FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
| Team member grouping | Divide by teamId, set a maximum of 50 members per team | The number of annotators per batch for image annotation projects typically does not exceed 50, to avoid data leakage risks |
| Image data isolation | Enable tmbId field-linked permissions | Image samples are bound to tmbId per batch, only allow corresponding team members to access data for their assigned batches |
| Role permission assignment | Annotators can only access annotation specifications and bounding box examples; quality inspectors can access quality inspection reports and rework lists | Match daily document usage scenarios to prevent unauthorized operations |
| SSO integration configuration | Enable SSO authentication, set timeout to 300 seconds | Adapt to fast authentication needs for internal deployment scenarios, avoid connection timeouts in internal network environments |
| Historical version synchronization | Enable team cloud synchronization, filter historical documents without tmbId | Fix permission verification failures caused by missing fields in older version documents |
| Internal network access restriction | Only open access to the configuration page for specified internal network IP ranges | Adapt to security requirements for internal deployments, prevent unauthorized external access |
Three common mistakes
- Creating multiple accounts to join the same team triggers an insufficient permissions prompt, and the addition cannot be completed. The cause is incorrect configuration of
teamIdgroup permissions, and the access range of the team member addition interface is not opened. - After internal network deployment, SSO integration fails, and the authentication process times out. The cause is not adding the authentication service port to the internal network whitelist, and not adjusting the timeout to a value adapted to the internal network environment.
- When synchronizing application historical versions to the cloud, older version documents fail to load normally. The cause is that older historical version documents do not include the
tmbIdfield, so the permission verification logic cannot match the access range of the corresponding team.
How to confirm the configuration is complete
- Log in to accounts with different roles. Attempt to access annotation specification documents separately, and confirm that only team members from the same team can view the corresponding documents.
- Upload a new batch of image samples. Confirm that only team members bound to the corresponding
teamIdcan view the data for that batch. - Trigger a historical version synchronization operation. Check whether older version documents load normally, and whether documents without the
tmbIdfield are filtered correctly. - Call the SSO authentication interface. Confirm that the authentication process completes normally, with no connection timeout or permission denied errors.
The values provided are common starting points, and should be evaluated against samples relevant to the target deployment context.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.