# Override Priorities for a User, Team, or Service Account ## Where to Configure What | Entity type | Where it lives | What you can configure | |------------------|------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------| | User | **Admin → Users → ** — **Query priority** section. See [Users](https://docs.kloudfuse.com/platform/4.1.0/administration/query-scheduling/query-priorities/per-entity/#user) below, or [Manage Users](https://docs.kloudfuse.com/platform/4.1.0/administration/access/users/) for general user management. | **Interactive** and **Machine** classes, wildcard + per-stream overrides. | | Team | **Admin → Teams → ** — **Query priority** section. See [Teams](https://docs.kloudfuse.com/platform/4.1.0/administration/query-scheduling/query-priorities/per-entity/#team) below, or [Manage Teams](https://docs.kloudfuse.com/platform/4.1.0/administration/access/teams/) for general team management. | **Interactive** and **Machine** classes, wildcard + per-stream overrides. Apply to every member of the team. | | Service Account | **Admin → Service Accounts → ** — **Query priority** section. See [Service Accounts](https://docs.kloudfuse.com/platform/4.1.0/administration/query-scheduling/query-priorities/per-entity/#service-account) below, or [Service Accounts](https://docs.kloudfuse.com/platform/4.1.0/administration/access/service-accounts/) for general service-account management. | **Machine** class only, wildcard + per-stream overrides. Service accounts never run interactive traffic. | --- ## Users The user detail page exposes both the **Interactive** and **Machine** class blocks, and is the only entity type that surfaces team-inherited rows. What’s specific to users: - **Two classes are exposed.** Browser traffic resolves through **Interactive**; bearer-token / MCP-OAuth traffic from the same user resolves through **Machine**. - **Team-inherited rows show up here.** When the user belongs to a team that has its own per-stream override, the user’s **Per-stream overrides** table shows that row even if the user has no override of their own. **Priority** and **Timeout** read **(unset)**, but **Effective** and **Source** reflect the team value (e.g. **Low · 30s** with `team "admin-team" (apm)` in the **Source** column). Setting a value on the row creates a user override that takes precedence; clicking the × on a purely-inherited row is a no-op (edit the team instead). - **Multi-team merge rule.** When the user belongs to multiple teams that supply different values for the same (class, stream), Kloudfuse picks the highest priority and the lowest timeout across the teams — most-permissive priority and strictest timeout win. The **Source** column names the team whose value was selected. For the field-by-field walkthrough, see [The Query Priority Section](https://docs.kloudfuse.com/platform/4.1.0/administration/query-scheduling/query-priorities/per-entity/#section) below. ## Teams The team detail page exposes both the **Interactive** and **Machine** class blocks. Whatever you configure on a team applies to every member of that team. What’s specific to teams: - **Configuration applies to every member.** A **Logs** override on the **oncall** team gives every member of **oncall** the same Logs budget. Members can still override the team’s value on their own user detail page if they need something more specific. - **Source label.** Rows owned by the team show **Source** = `group override ()` on the team’s own page. The same row appears as `team "" ()` on each member’s user detail page. - **Same shape as the user page.** The **Interactive** and **Machine** blocks render exactly like the user page — wildcard rows on top, per-stream overrides under the disclosure. ## Service Accounts The service-account detail page exposes the **Machine** class block only. Service accounts never run interactive traffic, so the **Interactive** block is intentionally absent. What’s specific to service accounts: - **Machine class only.** Bearer-token traffic from the service account always classifies as **Machine** — there is no Interactive class to configure. - **No team inheritance.** Service accounts don’t belong to teams, so their per-stream overrides table never shows team-inherited rows. - **Source label.** Rows owned by the service account show **Source** = `SA override ()`. ## The Query Priority Section Every entity detail page exposes a **Query priority** section with one block per applicable class. Each block matches the layout of the **Global query priorities** page, with one important difference: the **Effective** and **Source** columns reflect **what this entity will resolve to**, including any team-inherited or class-default values that fill in fields the entity hasn’t set itself. 1. **Class header** — **Interactive** or **Machine**. 2. **Priority (all streams)** and **Timeout (all streams)** — the entity’s own wildcard row. **(unset / use default)** means "I don’t have my own value; resolve from the next level of the chain." 3. **Effective** — what the resolution chain produces given the entity’s own row, any inherited team rows, and the cluster default. 4. **Source** — which step in the chain produced the effective value. Common values: `class default ()` **, `user override (apm)`, `group override (logs)`, `team "oncall" (apm)`, `SA override (`**`). 5. **Per-stream overrides** disclosure — surfaces stream-specific entries that override the wildcard row, **including team-inherited rows for users** (see [Users](https://docs.kloudfuse.com/platform/4.1.0/administration/query-scheduling/query-priorities/per-entity/#user) above). ## Set a Wildcard Override The wildcard row is the most common entry point — it overrides the cluster default for every stream the entity uses. 1. Open the entity’s detail page ( **Admin → Users / Teams / Service Accounts → **). 2. Locate the **Query priority** section and the class block you want to change. 3. In the **Priority (all streams)** drop-down, pick **High**, **Medium**, **Low**, or **(unset / use default)** to clear. 4. In the **Timeout (all streams)** field, enter a timeout in seconds, or leave blank to clear. 5. The **Effective** and **Source** columns update live so you can see what will actually be sent to Pinot. 6. Click **Save** at the top right of the class block. --- ## Add a Per-Stream Override Per-stream overrides on an entity detail page work the same as on the **Global query priorities** page. 1. Expand the **Per-stream overrides** disclosure. 2. Click **\+ Add per-stream override** and select a stream. 3. Set the **Priority** and **Timeout** for that stream. You can leave one or both blank to inherit from the wildcard or higher up the chain. 4. Click **Save** at the top right of the class block. A common pattern is to set the wildcard to **Medium** / **60s** and add a **Logs** override at **Low** / **120s** — quick metrics queries stay snappy, while long-tail log scans get more headroom. ## Remove an Override Removing an entity’s own row falls the resolution back to the next source in the chain — usually the cluster default, or a team-inherited row for users. ### Wildcard 1. Set **Priority (all streams)** to **(unset / use default)**. 2. Clear the **Timeout (all streams)** field. 3. Click **Save**. ### Per-Stream 1. Expand the **Per-stream overrides** disclosure. 2. Click the (×) icon on the row. 3. Click **Save**. If the row was team-inherited (the user has no own row, only an inherited display), the × button is a no-op — there’s nothing of the user’s to remove. Edit the **team** instead. ## Examples ### Give the Oncall Team Faster Log Queries 1. **Admin → Teams → oncall**. 2. In the **Query priority** section, expand **Per-stream overrides** under the **Interactive** block. 3. Add a **Logs** override: **Priority = High**, **Timeout = 120**. 4. Save. Every member of **oncall** now gets **High** priority and a 120-second budget for **Logs** queries, regardless of the cluster default. Other streams continue to resolve from the cluster default. ### Throttle a Single Heavy-Hitter User 1. **Admin → Users → [noisy@example.com](mailto:noisy@example.com)**. 2. In the **Query priority** section, set **Interactive** **Priority (all streams)** to **Low** and **Timeout (all streams)** to **30**. 3. Save. This user’s interactive queries now run at **Low** priority and time out at 30 seconds. Other users are unaffected. ### Give a Nightly-Export Service Account More Headroom 1. **Admin → Service Accounts → nightly-exporter**. 2. In the **Machine** class block, set **Timeout (all streams)** to **600**. 3. Save. The service account now gets a 10-minute budget for every Pinot call, while staying at the cluster-default priority. Use this pattern sparingly — large per-call budgets compete with interactive traffic when the scheduler is busy. ## Related Concepts - [Query Priorities Concepts](https://docs.kloudfuse.com/platform/4.1.0/administration/query-scheduling/query-priorities/concepts/) — what query priorities are and how the resolution chain works. - [Configure Cluster-Wide Defaults](https://docs.kloudfuse.com/platform/4.1.0/administration/query-scheduling/query-priorities/class-defaults/) — set the cluster-wide defaults that per-entity overrides build on.