What this category of data looks like
Data for this category primarily comes from object storage, data warehouses, annotation platforms, and customer acceptance feedback. Daily produced documents include dataset descriptions, version records, delivery lists, and acceptance reports. Data is updated per batch delivery or per version release. Data fields include version number, dataset unique identifier, delivery scope, permission binding identifier, and sample difference description. Common units are semantic version numbers, storage capacity units, and number of delivery items.
What constraints do these characteristics impose on permissions and data isolation
Documents such as dataset descriptions and version records contain sensitive delivery scope and customer acceptance feedback. The requirement to update per batch or version means permission bindings must match the version lifecycle. Different dataset batches have sample differences. Improper permission isolation leads to data mixing, which affects training reproduction and customer acceptance. The decentralized nature of data sources requires permission configurations to cover access restrictions for multiple data sources including object storage and data warehouses. This prevents cross-tenant data leaks. The complexity of version number management requires permissions to be bound to version identifiers. This ensures only authorized personnel can access delivery packages for corresponding versions.
How to configure settings
The following configurations apply to FastGPT v4.17.0.
| Configuration Item | Recommended Value | Rationale |
|---|---|---|
teamId | Assign based on tenant unique identifier | Matches the basic logic of multi-tenant isolation, ensuring datasets from different teams do not interfere with each other |
tmbId | Bind per delivery batch | Corresponds to dataset permissions for each batch or version, enabling precise version-level isolation |
| Permission group binding rules | Associate with delivery list fields | Only authorized data project managers and data engineers can access datasets with corresponding permissions |
| Access validity configuration | Set a 7-day validity period based on delivery cycle | Matches the rhythm of batch dataset updates, avoiding leakage risks caused by long-term open permissions |
| Single-tenant download threshold | No more than 1000 MB per single request | Limits the data download volume of a single tenant, preventing bulk sensitive data leaks |
Three common configuration mistakes
- Phenomenon: Attempting to access another tenant's dataset returns a 403 status code, and the corresponding version's delivery list cannot be viewed. Cause:
teamIdandtmbIdare not correctly bound, causing permission verification to fail to match the current tenant and delivery batch. - Phenomenon: Trained knowledge base content cannot be exported, or exported content lacks version identifiers and permission binding information. Cause: The association rule between permission groups and delivery list fields is not configured, causing permission verification to not trigger during the export process.
- Phenomenon: Team version permission management function cannot be enabled after local deployment. Cause: The
teamIdparameter is not correctly initialized, causing the multi-tenant isolation module to fail to load properly.
How to confirm the configuration is correct
- Log in to accounts from two different tenants, attempt to access unauthorized datasets respectively, and confirm that both return a no permission prompt.
- Upload new delivery batch data, verify that
tmbIdis automatically bound to the corresponding version's dataset description and delivery list. - After configuring access validity, wait beyond the set validity period, confirm that the corresponding batch of datasets can no longer be accessed.
- Perform a dataset export operation, confirm that the exported file contains complete version number, permission binding identifier, and delivery scope information.
The values given are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.