What the documents look like
Campaign plans, keyword reports, audience package descriptions and conversion attribution tables update daily or hourly in this category. A handover packet therefore captures one moment. Later bid changes, audience edits and attribution adjustments do not appear in the copy that was handed over. The permission boundary between a delivery specialist, a brand marketing team and an agency operator rarely shows up in the report values themselves. It shows up in who may change a bid, who may export an audience package, and who may confirm the attribution basis. These materials do not themselves grant authority. A form that collects values, and a retrieval result that returns a matching record, do not create an operating permission.
Because the underlying data refreshes on that cadence, a handover document can be internally consistent and still be out of date the next hour. Any later review of who held which permission has to compare the material against the state it describes, not against the current live account.
Constraints at the upgrades step
Before and after an upgrade, an old configuration name does not establish current behavior. AI Proxy is a required dependency from V4.17.0. Both the App service and an Admin service that reuses App/Service configuration must set AIPROXY_API_ENDPOINT and a non-empty AIPROXY_API_TOKEN. A missing item in either place fails startup validation. The endpoint takes the service root address, for example http://aiproxy:3000, without an appended /v1. The token must match the server-side configuration and must not be empty. Older OpenAI variables or a single-model custom request address do not substitute for these two settings.
The V4.17.2 upgrade includes manual-trigger scripts, visible and executable under the administrator version upgrade area. The historical chunk training task migration (20261008_migrate_chunk_training) and the knowledge base rebuild status migration (20261009_migrate_dataset_rebuild_status) are manual-trigger tasks that do not block service startup. The second depends on the first completing. The documented precondition is to confirm that all older FastGPT App and Pro instances in the cluster have fully stopped and that old task leases have expired before triggering execution. A retrieval hit does not perform permission isolation. A relevance score does not exclude unrelated business records or unauthorized records.
Hypothetical exercise sample for this page. The material text reads: "On 1 March 2026, the client brand marketing team handed the bid modification permission for Ocean Engine account A to the agency operator. The handover scope is limited to the keyword report and the audience package description, valid until 30 June 2026. The client retains the right to confirm the conversion attribution table." The draft sentence to be judged reads: "The agency has obtained all delivery permissions for account A and may directly modify the conversion attribution table and synchronize it externally."
Configuration and implementation checks
| Configuration item | Hypothetical starting value for this exercise | Reason for the choice and comparison object |
|---|---|---|
AIPROXY_API_ENDPOINT | http://aiproxy:3000 | Documented as a root address; compared against an address carrying an appended interface path, which does not conform |
AIPROXY_API_TOKEN | Empty, to be filled | Documented as non-empty and matching the server side; compared against the server-side configuration value |
CODE_SANDBOX_TOKEN | Set equal to SANDBOX_TOKEN | Documented as needing to match the sandbox service; compared against the actual sandbox configuration |
AGENT_SANDBOX_PROVIDER | Empty | Documented as not enabling the sandbox when empty; compared against whether the corresponding provider required variables are configured |
CHECK_INTERNAL_IP | false | Documented as applying only to user- or workflow-controllable outbound URLs; compared against the affected scope |
| Upgrade script precondition | Old instances stopped, leases expired | Documented as a confirmation before execution; compared against cluster instance state |
Three common errors
- Treating a retrieval hit as authority. The input is a retrieval request for the agency operator named in the sample above. The comparison object is the material text limiting the handover scope to the keyword report and the audience package description. The observable result is that when retrieval returns the conversion attribution table, this does not establish that the agency may modify that table. The material text states that the client retains the confirmation right for the attribution table.
- Treating a pending review as an approval. The input is a record showing that a handover request was submitted. The comparison object is the authorization state described by the material text, "valid until 30 June 2026." The observable result is that while the request sits in pending review, this does not establish that the permission has taken effect. A pending request does not establish the absence of an operating permission, and it does not establish that authority was granted.
- Treating form collection as execution. The input is a permission application form filled in by the agency. The comparison object is the authorization boundary in the material text. The observable result is that a submitted form does not establish that bid modification permission has transferred. Business verification, approval, database writes and external synchronization require their own stated downstream implementation.
How to verify the setup
- Against the sample text "valid until 30 June 2026," the input is the draft sentence "The agency currently holds bid modification permission for account A," dated 1 July 2026. The comparison object is the validity upper bound in the source text. The observable result is that when the draft sentence exceeds the validity period, it is judged unsupported, and the evidence gap is recorded.
- Against the sample text "the client retains the right to confirm the conversion attribution table," the input is the draft sentence "the agency may directly modify the conversion attribution table and synchronize it externally." The comparison object is the attribution of the confirmation right in the source text. The observable result is that when the draft sentence and the source text state mutually exclusive values for the same subject, the same object and the same field, it is judged contradictory.
- For empty-result handling, the input is the paper input
[]. The comparison object is whether the downstream design explicitly handles an empty result. The observable result is that when the downstream design does not describe empty-result handling, this is recorded as unsupported. No claim is made that a retrieval under a fictional rule necessarily returns[].
A completed step is not a zero-interruption commitment. Import, retrieval and application invocation should be rechecked with the same sample after the upgrade.