What the documents look like
The materials consist of sample evaluation forms, quality inspection reports, supplier qualifications, and prohibited-sales lists. They originate from supplier materials, testing agency reports, platform negative catalogs, and historical return rates, and are updated weekly per product. The present scope is limited to access controls and data isolation during contract and transaction material comparison.
A hypothetical drill sample is used. A product selection team stores a supplier qualification file in a knowledge base. The file name is "Supplier A Qualifications - 2024 Q4." The creator is Quality Inspector A. The original text contains two sentences: "Supplier A's business license is valid until March 31, 2025; the food business license number is a sample field, with an issuance date of October 12, 2024." The same knowledge base also contains a "Supplier A Sample Evaluation Form," with a draft sentence: "Supplier A's qualifications are within the validity period and can be used for this quarter's livestream product selection." The pending handover request is: Supply Chain BD B requests to export both materials together for external channel verification.
Constraints at the access controls step
Member permissions take priority, and department and group permissions are merged as a union. Resource types are checked by dataset and collection. File-level permissions are a commercial edition feature. When disabled by default, collection readability inherits from the knowledge base. When enabled, lists, details, and recall are authenticated against permission snapshots, and collection permissions cannot bypass the knowledge base. Recall filtering takes effect only when authentication is performed by current member identity. When a knowledge base is preselected and authentication is not performed by member identity, recall still follows knowledge base permissions. Relevance does not carry permission judgment. System root and team owners are treated as having all file permissions. Team administrators are still authenticated according to their respective collaborator configurations.
Configuration and implementation checks
| Configuration or check item | Assumed starting point in this exercise | Rationale and comparison method |
|---|---|---|
| Knowledge base file-level permission switch | Disabled | Documentation states disabled is the default behavior, and the system does not query collection permission records; compare with enabled state to observe whether lists and retrieval are authenticated item by item against snapshots |
| Knowledge base collaborators and roles | Quality Inspector A as manager | Documentation states knowledge base management permissions can configure collaborators; compare with member permissions to confirm individual member permissions override all-member group permissions |
| File creator | Quality Inspector A | Documentation states the creator cannot be granted or modified through collaborator configuration, and the submitted collaborator list must include the current creator |
| Supply Chain BD B access scope | Not granted as collaborator on the file | Compare with an authorized account to observe visibility differences for the same material in lists, details, and retrieval recall |
| Retrieval recall authentication method | Authenticated by current member identity | Documentation states this takes effect only when authenticated by member identity; compare with a preselected knowledge base without member-identity authentication to observe whether file-level filtering occurs |
| External channel export | Requires separate system implementation | Documentation does not describe an export interface or external authentication; verify separately from FastGPT resource permissions and record the gap |
Three common errors
- Treating retrieval relevance as permission filtering. The input is Supply Chain BD B searching for Supplier A qualifications in a knowledge base test, and the comparison object is the visible entries for that account in the file list. If the search result shows the file while the list does not, the retrieval entry is not authenticated by current member identity, and the workflow must be checked for a preselected knowledge base without member-identity authentication.
- Treating a pending review request as granted authorization. The input is Supply Chain BD B's export request, and the comparison object is that account's role in the knowledge base collaborator configuration. The request is pending. Documentation does not state that a request equals authorization, nor that the export action is performed by FastGPT. When no collaborator grant exists, the request does not constitute access permission and must be recorded as pending verification.
- Inferring file-level permissions from team administrator identity. The input is a team administrator account viewing Supplier A qualifications, and the comparison object is the file collaborator configuration. Documentation states that team administrators do not bypass file-level permissions, and team-level management permissions cover only the team's own resources. If that account can see all files, check whether it also holds system root or team owner identity; this cannot be used to infer that team administrators have file permissions by default.
How to verify the setup
- Verification one: the input is the original text of "Supplier A Qualifications - 2024 Q4" in the sample and Supply Chain BD B's export request. The comparison objects are that account's role in the knowledge base collaborator configuration and the file creator field. The expected observation is that when the account is not listed as a collaborator on the file, the file list and details are not visible; the export request remains pending, and documentation does not state that export is performed by FastGPT. If the file is visible in the list, record the actual observation and check the authentication entry.
- Verification two: the input is the draft sentence "Supplier A's qualifications are within the validity period and can be used for this quarter's livestream product selection," along with the two original sentences. The comparison objects are the business license validity date of March 31, 2025, the food business license issuance date of October 12, 2024, and the validity period stated in the draft sentence. A contradiction exists only when the same field has explicitly mutually exclusive values. The original text does not state the food business license validity period; that part is unsupported and cannot be judged as negation or conflict.
- Verification three: the input is Quality Inspector A's account and Supply Chain BD B's account querying the same "Supplier A Sample Evaluation Form." The comparison object is the set of visible files for the two accounts in retrieval recall. The expected observation is that when authentication is by current member identity, unreadable files do not enter recall; if the workflow preselects a knowledge base without member-identity authentication, the recall results for the two accounts are identical, and this scenario is recorded as not performing file-level filtering. An empty result can be checked against an explicit paper input [] for downstream design; no claim is made that a fictional rule retrieval must return [].