What the documents look like
Tmall flagship store operations compare four document types in day-to-day contract and transaction material work: product listing pages, brand authorization letters, delivery commitment records, and after-sales tickets. A brand authorization letter and a product listing page carry corresponding fields for the authorizing party, the authorized scope, and the validity period. Delivery commitment records and after-sales tickets carry corresponding fields for time and quantity. These materials come from the Tmall merchant backend, the Tmall rules center, ERP order tables, and customer service chat records. Their update frequency is daily and per order. Comparison work checks whether the same field holds the same value across these sources. Access controls and data isolation determine who can see which materials and who can perform which comparison actions.
The Tmall flagship context places weight on brand authorization, flagship store identity, and Tmall points compensation rules. Errors in this environment can lead to product delisting, delayed shipment compensation, and a drop in store rating. Access control sits underneath those outcomes because a comparison result is only meaningful when the person performing it can read the source materials and the person receiving a handoff is authorized to act on them.
Constraints at the access controls step
FastGPT combines attribute-based and role-based permission management. Three management modes configure resource access: members, departments, and groups. Member permissions have the highest priority. Department and group permissions are combined as a union and rank below member permissions. Resource types include team, app, dataset, agentSkill, and collection. Knowledge base file-level permission is a commercial-edition feature. In the closed state, collection readability matches the knowledge base. In the open state, each file generates a permission snapshot, and list, detail, and retrieval recall all authenticate entry by entry against that snapshot. Knowledge base permission remains the threshold: collection permission cannot bypass knowledge base permission. Retrieval recall filters by the files the current member can read, and this applies only when authentication uses the current member identity. A workflow that preselects a knowledge base without member-identity authentication does not perform file-level filtering. A team administrator does not bypass file-level permission. System root and the team owner are treated as having full permission over all files.
A retrieval relevance score is not a category, entity, or permission filter. Similarity settings do not exclude unrelated businesses or unauthorized records. Retrieval is not authorization. Forms collect values; business verification, approval, database writes, and external synchronization require their stated downstream implementation.
Hypothetical paper exercise sample: a Tmall flagship operations team stores brand authorization letter scans, product listing page screenshots, delivery commitment records, and after-sales tickets in four knowledge base folders. The authorization letter text reads: "Authorizing party A authorizes B to sell brand C products on the Tmall platform, authorization period 1 January 2025 to 31 December 2025, authorized category household appliances." The product listing page text reads: "Brand C, category household appliances, delivery commitment within 48 hours." A pending handoff request reads: "Grant the customer service group read permission on the authorization letter folder so it can check brand information in after-sales tickets." This request concerns collection-level permission configuration. It requires first confirming that the knowledge base has file-level permission enabled, then confirming whether the customer service group holds read permission on that knowledge base.
Configuration and implementation checks
| Configuration item | Assumed starting value for this exercise | Reason for the choice and comparison method |
|---|---|---|
| Knowledge base file-level permission switch | Closed | The documentation describes the closed state as the default behavior; opening it materializes permission snapshots for all files and takes longer when there are many files. Compare the actual switch state against the documented open and closed states. |
| Authorization letter folder collaborator | Customer service group, read permission | Compare against the knowledge base read permission to confirm the customer service group already holds the threshold permission. |
| Product listing page folder collaborator | Operations group, write permission | Compare against the creator field; the submitted collaborator list must include the current creator. |
| Retrieval recall authentication method | By current member identity | Compare against the preselected knowledge base without identity authentication, which does not perform file-level filtering. |
| Team administrator file permission | Does not bypass | Compare against system root and team owner, which are treated as having full permission. |
The file-level permission switch is the only entry point that produces collection-level custom permission. When it is not enabled, any write operation configuring an individual file permission is rejected with a prompt to enable it first. Enabling requires knowledge base administrator permission. Materialization completes synchronously within the request. The system sets the switch only after materialization succeeds; on failure the switch remains closed and the operation can be repeated because it is idempotent. Closing deletes all file and folder collaborator configurations under that knowledge base and restores inheritance from the knowledge base. Closing cannot be reversed, and the interface requires a second confirmation. Reopening after closing is equivalent to the first opening.
Three common errors
- Treating retrieval relevance as permission filtering. A relevance score does not perform entity or permission isolation. Input the same query term and search the authorization letter folder with an authorized account and an unauthorized account, then compare whether the returned results match. If they match, authentication did not take effect.
- Treating a pending handoff request as already authorized. The customer service group request above is in a pending state and no grant has been executed. Compare the request text against the actual knowledge base collaborator list. If the list does not contain the customer service group, the request is not supported.
- Treating team administrator identity as a file-level permission bypass. The documentation states that a team administrator does not bypass file-level permission. Search the authorization letter folder with a team administrator account and compare its visible files against the files visible to the creator. If they differ, file-level authentication is executing according to collaborator configuration.
How to verify the setup
- Input the authorization letter text and the product listing page text given above, and compare the values in the brand name and category fields. If brand C and household appliances match in both materials, that field check passes. If they differ, record the difference and retain the source text.
- Input the handoff request text given above and compare the customer service group named in the request against the knowledge base collaborator list. If the list does not contain the customer service group, the request remains pending verification and is not treated as authorized. If the list contains it with read permission, the request has been carried out.
- Input the empty-result scenario: assume retrieval returns an empty list, and compare that empty result against the downstream design expectation. If the downstream design expects no matching material, the empty result matches the expectation. If the downstream design expects all materials to be returned, inspect the authentication scope and the retrieval entry point.
A pending request is not approval. An offered option is not execution. An unsigned termination is not a completed termination. Where a document field is not provided, the value remains unknown.