What the documents look like
Receiving and putaway covers the first physical-and-record confirmation that goods have entered the warehouse. The working materials are purchase arrival notes, inbound acceptance records, putaway tasks, and discrepancy reports, drawn from the WMS, ERP purchasing, supplier delivery notes, and barcode scanning. A purchase arrival note records the supplier and the delivered scope; an inbound acceptance record records what was actually received; a putaway task records bin assignment; a discrepancy report records quantity or batch deviations.
For operations handover, the question is narrower than document content. Each material, action, and request sits at a particular authorization state. A purchase arrival note does not by itself grant anyone the right to amend receiving results. An inbound acceptance record does not by itself authorize a later correction. A discrepancy report does not by itself authorize the person named on it to write to that record. The handover step must establish which state applies to the specific object being passed on. Retrieval and forms collect or surface values; they do not perform the authorization act.
Constraints at the access controls step
FastGPT combines attribute-based and role-based permission management. Access to resources such as teams, applications, and knowledge bases is configured through members, departments, and groups. Member permissions have the highest priority. Department and group permissions are combined as a union and rank below member permissions. The final permission is the combination of these results.
File-level permission inside a knowledge base is a commercial-edition feature. In the closed state, collection readability matches the knowledge base exactly, and the system does not query any collection permission records. In the open state, each file or folder generates a full permission snapshot, and lists, details, and retrieval recall are authorized item by item against that snapshot. Knowledge base permission is always the threshold; collection permission cannot bypass it. A user granted access to a single file still needs read permission on the knowledge base to reach it.
Retrieval recall filters by the files the current member can read, and this applies only when authentication runs as the current member identity. A workflow that preselects a knowledge base without member-identity authentication does not perform file-level filtering and still recalls under knowledge base permission. Retrieval is not authorization. A similarity score is not a category, entity, or permission filter, and it does not exclude unrelated businesses or unauthorized records.
Hypothetical drill sample. A purchase arrival note reads: "Supplier A delivered 200 units of product A on 10 March 2025, purchase order PO-0310." The corresponding inbound acceptance record reads: "Receiver B accepted 180 units of product A on 10 March 2025, discrepancy 20 units, discrepancy report number D-0310." A handover request pending judgment reads: "Grant write permission on discrepancy report D-0310 to receiver C for later supplementary entry." The object is discrepancy report D-0310. The proposed action is write permission. The stated authorization boundary is supplementary entry. The materials do not state whether C already holds read permission on the relevant knowledge base.
Configuration and implementation checks
The table below lists documented settings or implementation checks relevant to this page's sample.
| Configuration item | Setting or check content | Relation to the sample |
|---|---|---|
| Knowledge base file-level permission switch | Confirm whether the target knowledge base has file-level permission enabled; in the closed state a write operation configuring a single file permission is rejected | If the knowledge base holding D-0310 is not enabled, the write grant cannot be submitted |
| Collaborator and role | The configuration dialog selects a member, member group, or organization and assigns read permission, write permission, or administrator | Check whether C appears in the collaborator list and whether the proposed write permission matches supplementary entry |
| Creator retention | The submitted collaborator list must contain the current creator, otherwise it is rejected | If B is the creator of D-0310, a full overwrite must retain B's record |
| Full overwrite semantics | The submitted list is the final result | Check whether the proposed submission contains only C and omits B |
| Retrieval recall authorization | Filtering runs by the files the current member can read; files beyond authorization are not recalled | Check whether C holds read permission on the knowledge base so that retrieval visibility and authorization agree |
| Closing consequence | Closing deletes all file collaborator configurations under that knowledge base and restores inheritance; this cannot be reversed | Confirm switch state before handover so authorization records are not cleared |
The hypothetical trial starting point for this page is: grant write permission on discrepancy report D-0310 to receiver C. This value is chosen because the request points explicitly to supplementary entry and must be distinguished from read permission. The comparison object is C's actual role in the current collaborator list.
Three common errors
- Treating retrieval visibility as authorization execution. Retrieval filters by the files the current member can read, and recall results reflect only the readable range; they do not constitute a grant of write or administrative permission. Check the input of C's account and D-0310, compare retrieval visibility against the collaborator list role, and if the item is visible in retrieval while the list holds no write permission, the authorization is not complete.
- Omitting the creator during full overwrite. Collaborator configuration uses full overwrite semantics, and the submitted list is the final result. Check the input of the proposed submission list against the creator record of D-0310, compare whether both contain the creator, and if the list omits the creator the submission is rejected.
- Conflating knowledge base permission with collection permission. Knowledge base permission is the threshold, and collection permission cannot bypass it. Check the input of C's knowledge base read permission and D-0310 write permission, compare whether the two are held separately, and if knowledge base read permission is missing the file-level grant cannot take effect.
How to verify the setup
- For the handover request in the hypothetical sample, the input is discrepancy report D-0310, receiver C, and proposed write permission. Compare C's knowledge base read permission against C's actual role in the D-0310 collaborator list. The condition is met when knowledge base read permission exists, the collaborator list contains C with write permission, and the list retains creator B. If the list omits B, the submission is rejected and the condition is not met.
- For retrieval recall authorization, the input is C's account and a retrieval request against the knowledge base holding D-0310. Compare whether D-0310 appears in the retrieval result. The condition is met when C holds knowledge base read permission and D-0310 is readable, so the item appears; if C lacks knowledge base read permission, D-0310 does not appear, and that observation is recorded. An empty result can be checked against a downstream design using the explicit paper input []; no claim is made that a fictional rule would necessarily return [].
- For switch state, the input is the current state of the knowledge base file-level permission switch. Compare the result of a write operation configuring a single file permission in the closed state against the open state. The condition is met when the open state permits submitting collaborator configuration and the closed state rejects the write operation with a prompt to enable first. If the switch is closed, it must be enabled before handover; enabling materializes synchronously within the request, and if it fails midway the switch remains closed and the operation can be re-run.
Across all three checks, the knowledge base holding D-0310 must be within an accessible target retrieval scope or an explicit manual input. Where that access is absent, record the gap rather than supplying a conclusion. A pending request is not approval, an offered option is not execution, and an unsigned termination is not a completed termination.