What This Category of Data Looks Like
Data for the ad creative review scenario includes four types of daily documents: ad creative files, landing page screenshots, review opinion documents, and modification records. Data sources include ad delivery platforms, landing page hosting services, product qualification filing systems, and advertising law compliance clause libraries. Update frequency is daily or real-time, synchronized with creative submission and review progress. Document fields include the unique identifier of ad creatives, landing page URL, and associated ticket ID of review opinions. Some historical documents have missing fields; for example, records from earlier versions do not include the tmbId field.
Constraints Imposed on Permission and Data Isolation
The multi-stakeholder collaboration model for ad creative review requires dividing data permissions by business team and role, to prevent leakage of cross-team creatives and review records. The real-time or daily data update rhythm requires permission isolation rules to take effect in real time, ensuring newly submitted creatives and review records can quickly match corresponding permissions. The missing tmbId field in historical documents will cause some old data to fail regular permission checks, requiring additional compatible configuration rules. Data from different sources must use unified isolation dimensions to avoid permission confusion across ad platforms and qualification libraries. Internal ticket Q&A must associate permission information of corresponding creatives, ensuring tickets only return content belonging to the relevant team. This configuration solution is adapted for FastGPT v4.17.0.
How to Configure Settings
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
teamId | Assign a unique identifier per business team, bind 1–50 permission rules | Matches the team collaboration model of ad creative review, ensuring team members can only access creatives and review records belonging to their own team |
tmbId | Enforce validation for real-time updated data, automatically assign historical data with missing fields to the initial creating team | Resolves compatibility issues for older documents without the tmbId field, preventing unauthorized access to historical data |
| Permission Isolation Scope | Divide secondary isolation dimensions based on the ad account to which the creative belongs and the landing page domain name | Refines permission boundaries, aligning with the actual delivery attribution logic of ad creatives |
| Data Access Cache Expiry | 600 seconds, automatically refresh permission rules after timeout | Balances real-time performance and system load, adapting to daily or real-time data update rhythms |
| Ticket Association Rule | Bind the teamId and tmbId of the corresponding creative | Ensure internal ticket Q&A only returns review records and creative information associated with the relevant team |
Three Common Misconfigurations
- Symptom: Some historical versions of creative review records fail to load normally in the ticket system, with the interface displaying "Permission check failed". Cause: No default attribution rule configured for older documents without the
tmbIdfield, causing historical data to fail permission checks. - Symptom: Cross-team ticket queries return creative content that does not belong to the current team, with logs showing a
403 Forbiddenerror. Cause:teamIdis not used as a core isolation parameter, and permission judgments only rely on usernames, making it impossible to distinguish data ownership across different business teams. - Symptom: Intranet-deployed ticket services experience connection timeouts when querying creative data, with database logs showing access denied. Cause: No
teamId-based database access whitelist configured, and permission requests across network segments are not properly intercepted.
How to Verify Successful Configuration
- Randomly select 3 historical creative records without the
tmbIdfield, verify that the rule automatically assigning them to the initial creating team takes effect. - Switch test accounts with different
teamIdvalues, confirm that only creatives and review records belonging to the corresponding team can be accessed. - Generate a publicly accessible link, verify that unauthorized accounts cannot view creative data from other teams.
- Check database logs, confirm that only services from specified intranet network segments can access the creative data storage repository.
The values given are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.