Set budgets and quotas
For: tenant administrators and cost owners.
A tenant's monthly budget caps what the whole tenant spends. Quotas divide it: what one person's, app's or team's jobs may spend in a month, how many of their jobs may run at once, and how many they may start in a day. When someone needs more, they ask, and an admin approves it for a while.
Choose a task
| Task | Guide |
|---|---|
| Understand quota charging and refusals | Open guide |
| Request and review budget | Open guide |
Teams
A team is a group in a tenant: people (user:<name>), API keys (apikey:<id>) and the identities routines run as (service:<name>). A team's admins decide its budget requests. The tenant's admins manage teams:
oz0 team create ml --display-name "Machine learning"
oz0 team add ml kim # a person; the same as user:kim
oz0 team add ml lee --role admin # decides the team's budget requests
oz0 team add ml apikey:k-3f2a # an app's key
oz0 team list
oz0 team remove ml kim
oz0 team delete ml
A person must be a member of the tenant to join one of its teams. Leaving the tenant, or having the account deleted, takes them out of its teams; revoking a key takes the key out. Routines and inventory entries name their owner team by its name: it must be one of the tenant's teams, and a team that owns a routine or an entry cannot be deleted until they name another.
A team's spending stays under its name: a team deleted and created again in the same month carries on where it was, but a deleted team's approved requests end.
Teams that nobody answers for
A team that owns routines or inventory entries and has no person as a member, or no person as its admin, is orphaned: its routines go on firing as the team while nobody can answer for them. That happens when the last person leaves the tenant or their account is removed. Keys and services in a team do not count: they cannot answer for anything. Within a minute of it, oz0 doctor lists the team under orphaned teams with what it owns, and the tenant's admins get team.orphaned once (notifications). Adding a person as its admin clears it.
A tenant may also pause such a team's routines after a number of days, with the reason (paused by system:team.orphaned). It is off by default; turning it on or shortening it applies at once, and turning it off or lengthening it takes a reason and, with four eyes on, a second admin. Paused routines never resume by themselves: a person resumes them once the team has an owner again.
oz0 tenant orphan-pause acme # shows it
oz0 tenant orphan-pause acme --days 14 --reason "routines need someone who answers for them"
oz0 tenant orphan-pause acme --days 0 --reason "a reorganisation; back on 1 November"
A routine's fire counts as a job of the routine's identity (service:<run_as>), charged to its owner team. A fire that a webhook, "run now" or the test bench starts is not started when it is over a quota (its webhook gets 429). A fire that a schedule starts asks the edge first, before it runs a step: over a quota, it fails with QuotaExceeded and the reason, and does not count toward pausing the schedule after failed fires in a row.
Quotas
A quota is about one subject and limits up to three things; a limit you leave out is no limit:
oz0 quota set team:ml --usd 500 --running 5 # $500 a month, 5 jobs at once
oz0 quota set kim --usd 50 --per-day 20 # $50 a month, 20 jobs a day
oz0 quota set '*' --usd 25 # everyone without a quota of their own
oz0 quota set 'team:*' --running 10 # every team without one
oz0 quota set operator:ci --per-day 200 # an operator certificate, by name
oz0 quota set kim # no limits: removes kim's quota
oz0 quota list
| Limit | Flag | Counted |
|---|---|---|
| Money | --usd | What the subject's jobs spend in a calendar month (UTC): model calls, and what plugins report, for each job and every job it delegates to |
| Jobs at once | --running | Top-level jobs that run now; jobs they delegate to are part of them |
| Jobs a day | --per-day | Top-level jobs started per UTC day; a retry of a start (the same job ID and request) does not count again, and an ended job's ID never starts a new job |
Quotas come on top of the tenant's budget: a call must fit both. Operator certificates, which the CLI uses, fall only under a quota set for them by name (operator:<name>); the defaults are for people, keys and services. Jobs the platform starts itself, such as a quality gate's eval cases, fall under none.
Previous section links
Who a job is charged to: open guide.
When a quota is reached: open guide.
Budgets and tool calls: open guide.
Ask for more: open guide.
My budget and spend alerts: open guide.
Usage per user and team: open guide.
Console budget pages: read this section.