What the documents look like
Cross-border standalone-site payment risk work centers on card-network disputes and receiving accounts. The daily material set includes payment chargeback notices, fraudulent order lists, invoices, and carrier proof of delivery. These items arrive from Stripe or PayPal back offices, Shopify orders, carrier signature records, and customer service email. The brief records a daily and per-order update frequency. The most time-consuming steps are identifying high-risk orders, preparing chargeback evidence, and tracking frozen funds. Errors produce chargeback losses, account freezes, and interrupted ad delivery.
Because material is produced daily and per order, one batch of files can sit at different processing stages at the moment of an operations handover. The access-control question is narrow: for a given file, folder, or operation request, what authorization state does each side of the handover hold. A retrieval hit and a completed form are both separate from authorization.
Constraints at the access controls step
FastGPT separates member permissions from department and group permissions. Member permissions carry the highest priority; department and group permissions combine as a union. Resource types include team, app, dataset, and collection, where collection covers a file or folder.
Dataset permission is always the threshold. Collection permission cannot bypass dataset permission. File-level permission is a commercial-edition feature. In the closed state, collection readability matches the dataset exactly and the system queries no collection permission records. In the open state, each file and folder generates a permission snapshot, and lists, details, and retrieval recall are authorized item by item against that snapshot. Deletion is limited to the creator; a collaborator holding admin or write permission cannot delete. A team administrator does not bypass file-level permission. Retrieval recall filters only when authorization runs as the current member identity; a workflow that preselects a dataset without member-identity authorization performs no file-level filtering. Similarity and relevance carry no permission or entity-isolation duty.
Hypothetical paper exercise. A standalone-site risk specialist submits a handover request to transfer collaborator permission on the folder "March 2025 chargeback notice summary" to a finance settlement role in the same team. The source text for comparison reads: "The folder creator is risk specialist A. On 1 April 2025, A submitted a collaborator list containing A and finance colleague B, with the read permission role. File-level permission for the dataset is in the open state. B holds read permission on the dataset." The draft sentence to be judged reads: "B has obtained write permission on this folder and can modify chargeback evidence and perform deletion." The draft sentence disagrees with the source on the role field, and deletion is limited to the creator, so B does not hold it.
Configuration and implementation checks
| Check item | Documented setting or implementation check | Hypothetical starting point and comparison method |
|---|---|---|
| File-level permission switch | Entered from the dataset detail page file list, target row menu, permission entry; a dataset administrator can open it | Start in the open state, compared with the closed state, where no collection permission records are queried |
| Collaborator roles | Read permission, write permission, administrator, creator | Start at read permission, compared with the write permission claimed in the draft sentence for field agreement |
| Creator retention | The submitted collaborator list must contain the current creator | Start with A present in the list, compared with a list that drops the creator record to see whether it is rejected |
| Inherited and independent states | Inherited state follows the parent; independent state is not overwritten by the parent | Start in the inherited state, compared with whether a single configuration turns the node independent |
| Retrieval recall authorization | Files beyond permission are filtered when authorization runs as the current member identity | Start with member-identity authorization, compared with a preselected dataset without member-identity authorization for whether filtering occurs |
| Special identities | System root and team owner hold all permissions; team administrator does not bypass | Start as team administrator, compared with file-level permission for whether it is bypassed |
Three common errors
- Treating a retrieval hit as authorization. Input: B hits the folder in a dataset search test. Comparison: B's collection read permission record. If that record is absent, the hit does not constitute access authorization.
- Accepting the role field in the draft sentence at face value. Input: the draft sentence claims B holds write permission. Comparison: the read permission in the source collaborator list. A field mismatch leaves the draft sentence unsupported.
- Equating administrator permission with deletion permission. Input: B is granted administrator. Comparison: deletion is limited to the creator. If B is not the creator, the deletion operation does not hold.
How to verify the setup
- Input the hypothetical source text and the draft sentence. Compare the role field and the creator field. If the write permission claimed in the draft sentence disagrees with the read permission in the source, and the deletion subject is not the creator, the draft sentence is unsupported.
- Input B's account and the target folder from the hypothetical exercise. Compare whether dataset read permission and collection read permission are both present. If the collection permission record is missing, B cannot view the folder contents. A paper input of [] can be used to check the downstream design for an empty result; no claim is made that a fabricated rule returns an empty result.
- Input the member-identity-authorized retrieval request from the hypothetical exercise. Compare whether the recall result contains a file beyond permission. If the recall result shows a file for which B holds no read permission, the item-by-item snapshot authorization condition is not met.