What Data in This Category Looks Like
Data for this category originates primarily from data asset inventories, database metadata, business system descriptions, and compliance-related documents. Update frequency is quarterly or following a single business system change. Daily deliverables include data catalogs, classification and grading rules, important data identification tables, and review minutes, maintained by data governance teams, security consultants, and legal and compliance staff. Data fields include asset unique identifiers, classification levels, sensitivity tags, affiliated tenant scope, and other attributes. There are no unified fixed units; values adjust based on the specific properties of each asset item.
Constraints for Permission and Data Isolation
Data sources cover multiple types of business assets and compliance documents. This requires permission isolation to match the tenant boundaries of different business systems, to prevent cross-tenant data leaks. Structural differences across document types require setting differentiated permission scopes for items such as data catalogs and classification rules. Data updated quarterly or on demand needs permission policies that can adjust dynamically, without full reconfiguration. For scenarios with multiple maintenance roles, operation permissions must be split for positions including data governance and compliance review, to stop unauthorized modification of grading rules or leakage of sensitive data.
Configuration Settings
These configuration items apply to FastGPT v4.17.0. The specific configurations are as follows:
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
Team ID teamId | Unique identifier divided by business system | Match the tenant boundaries of business systems to isolate classification and grading data for different businesses |
Tenant ID tmbId | Unique identifier divided by compliance domain | Distinguish sensitive data across different compliance domains to avoid cross-domain permission leaks |
| Permission role division | Split into three categories: data governance, review, and read-only based on job responsibilities | Match the different operation needs of data governance teams and compliance consultants |
| Sensitive data access scope | Only visible to administrator groups and compliance review groups | Prevent unauthorized personnel from viewing important data identification tables |
| Configuration activation delay | 10–30 seconds | Adapt to dynamic update frequencies, balance real-time performance and system load |
| Knowledge base binding rules | Bind corresponding business knowledge bases by teamId | Ensure that trained classification and grading rules are only visible within the corresponding tenant |
Three Common Configuration Mistakes
- Symptom: Cross-tenant users can view classification and grading rules for other businesses, and the interface returns more data entries than expected. Cause: Knowledge bases for corresponding businesses are not bound by
teamId, and permission isolation configuration is not activated. - Symptom: After configuring permissions, compliance consultants cannot edit review minutes, and logs show the
tmbIdfield is empty. Cause: The mapping relationship betweentmbIdand roles is not correctly configured, and role permissions are not associated with the corresponding tenant. - Symptom: Some newly added assets in the important data identification table are not included in permission control, resulting in unmanaged data. Cause: Permission synchronization is not configured according to the data update frequency, and new assets do not trigger permission policy updates.
How to Confirm Successful Configuration
- Log in to tenant accounts corresponding to different
teamIdvalues, and verify that only classification and grading rules and data catalogs for the current business can be viewed. - Assign corresponding permissions to different job roles, and verify that roles can only perform operations within their job scope, such as review roles being unable to modify classification rules.
- Trigger a new asset inventory data update, and verify that the permission policy takes effect synchronously with the data update, with no cross-tenant data leakage risks.
- Attempt to export the data catalog, and verify that roles assigned export permissions can operate normally, while unauthorized roles cannot access the export entry.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.