What the documents look like
Wholesale stall trading is fragmented. Prices are agreed face to face, and goods move by consignment. The records that change hands during an operations handover are purchase notes, handwritten sales slips, stall lease contracts and payment receipts. Their sources include wholesale market quotations, stall inventory, WeChat payments and logistics consignment notes, and they are updated daily or per order. For this page, the relevant consequence is that a handover asks who may view, change or pass on each of these records, and a retrieval setting, a file category or an external system login does not answer that question. Access has to be checked account by account.
In FastGPT v4.17.2, team permission is decided by combining member permission with the union of department and group permissions, and member permission has the highest priority. File-level permission inside a knowledge base is off by default. In the off state, the readability of a collection matches the knowledge base. When it is on, each file or folder receives a complete permission snapshot, and the list, the detail view and retrieval recall are each authorised against that snapshot. Knowledge base permission remains a threshold: collection permission cannot bypass it. Retrieval recall is filtered by file-level permission only when authentication uses the current member identity. A workflow that preselects a knowledge base without member-identity authentication does not filter by file. System root and the team owner are treated as holding all permissions on all files. A team administrator does not bypass file-level permission.
Constraints at the access controls step
Several conditions bear directly on a handover. A collaborator must be added before permission can be managed for that person. For applications and knowledge bases, member permission can be modified directly, while team permission is set on a dedicated permission page. The administrator role manages collaboration relationships but cannot modify or remove its own permission, cannot modify or remove another administrator's permission, and cannot grant administrator permission to another collaborator. Each resource has a single Owner with the highest permission on that resource; transferring ownership removes the original Owner's permission on that resource.
For collections, the switch is the only entry point that produces custom collection-level permission. While it is off, any write that configures permission for a single file is rejected with a prompt to enable it first. Enabling requires knowledge base manage permission. Materialisation completes synchronously inside the request and can take a long time when there are many files; the switch is set only after materialisation succeeds, and a mid-way failure leaves it off, with re-execution being idempotent. Disabling removes all collaborator configurations for every file and folder under that knowledge base and restores inheritance, and it cannot be reversed. Collaborator configuration uses full overwrite semantics: the submitted list is the final result, and the list must contain the current creator or it is rejected. The creator cannot be granted or modified through collaborator configuration. An inherited node that has parent-derived collaborators modified or removed prompts a conflict, and after confirmation becomes independent rather than silently rewriting the parent.
Assume a paper exercise sample. A stall owner, A, hands a batch of purchase notes and handwritten sales slips to a shop assistant, B. The material text reads: "On 10 March 2025, A purchased 200 boxes of dried chilli from supplier C, payment receipt number A-0310, stall lease contract number Z-2025, lease term to 31 December 2025. A authorises B to view and modify the above purchase notes and handwritten sales slips between 10 March and 20 March." A draft sentence to be assessed reads: "B is entitled to pass the above purchase notes and handwritten sales slips to buyer D on 25 March." The authorisation boundary here is 10 March to 20 March, and the objects are the purchase notes and handwritten sales slips, excluding the stall lease contract and the payment receipt.
Configuration and implementation checks
| Check item | Material on this page | How to check |
|---|---|---|
| Member permission and group permission union | A authorises B to view and modify purchase notes and handwritten sales slips | Review B's member permission record and confirm whether it contains read and write permission for that knowledge base or file |
| Knowledge base file-level permission switch state | Purchase notes, handwritten sales slips, stall lease contract, payment receipt | Confirm whether the target knowledge base has file-level permission enabled; in the off state, collection permission inherits from the knowledge base |
| Collaborator list full overwrite | B's collaborator configuration | The submitted collaborator list must contain the current creator, otherwise it is rejected |
| Retrieval recall under member-identity authentication | Retrieval entry for purchase notes and handwritten sales slips | A workflow that preselects a knowledge base without member-identity authentication does not filter by file |
| Team administrator does not bypass file-level permission | Team roles of A and B | Team-level management permission covers only the team's own resources; the knowledge base and files are still authorised by their own collaborator configuration |
| Creator constraint and disabling effect | Creator of each collection; switch state | The creator cannot be granted or modified through collaborator configuration; disabling deletes all collaborator configurations under that knowledge base and restores inheritance, without reversal |
Three common errors
- Treating retrieval relevance or file category as access authorisation. Input is B's account and a retrieval request over purchase notes. Compare the retrieval setting with the collaborator configuration, and observe whether the result is filtered by the files B may read. Where the retrieval setting does not authenticate by member identity, a file beyond B's permission may be recalled, and authorisation cannot be treated as effective on that basis.
- Treating a pending or to-be-handed-over state as completed authorisation. Input is the draft sentence about passing records on 25 March. Compare the authorisation period of 10 March to 20 March with the draft date of 25 March, and observe whether the date falls inside the valid range. The 25 March date lies outside the authorisation boundary, and the draft sentence is not supported.
- Treating the team administrator role as bypassing file-level permission. Input is B's team administrator identity and the file-level permission configuration. Compare team-level management permission with the file collaborator configuration, and observe whether B remains bound by file-level permission. A team administrator does not bypass file-level permission, and the knowledge base and files are authorised by their own collaborator configurations.
How to verify the setup
- Using the sample text in which A authorises B, input B's account and the purchase note file. Compare the authorisation period of 10 March to 20 March with the access date, and observe whether B can view and modify the purchase note inside the authorisation period. The condition is met when B can read and write between 10 March and 20 March, and cannot read outside that period.
- Using the draft sentence about passing purchase notes and handwritten sales slips on 25 March, input the draft date of 25 March and the authorisation deadline of 20 March. Compare whether the two fall in the same period, and observe whether the date exceeds the authorisation boundary. The condition is met when the draft date falls inside the authorisation period; otherwise the request is not supported.
- Using the stall lease contract and payment receipt in the sample, input B's account and these two document types. Compare the authorised objects with the document types, and observe whether B can view the stall lease contract and the payment receipt. The authorised objects are the purchase notes and handwritten sales slips, excluding the stall lease contract and the payment receipt, and the condition is met when B has no read permission on these two document types. Where evidence is missing, record the gap and do not supply authorisation terms.