Override Priorities for a User, Team, or Service Account

Where to Configure What

Users

The user detail page exposes both the Interactive and Machine / Agent class blocks, and is the only entity type that surfaces team-inherited rows.

What’s specific to users:

• Two classes are exposed. Browser traffic resolves through Interactive; bearer-token / MCP-OAuth traffic from the same user resolves through Machine / Agent.
• Team-inherited rows show up here. When the user belongs to a team that has its own per-stream override, the user’s Per-stream overrides table shows that row even if the user has no override of their own. Priority and Timeout read (unset), but Effective and Source reflect the team value (e.g. Low · 30s with team "admin-team" (apm) in the Source column). Setting a value on the row creates a user override that takes precedence; clicking the × on a purely-inherited row is a no-op (edit the team instead).
• Multi-team merge rule. When the user belongs to multiple teams that supply different values for the same (class, stream), Kloudfuse picks the highest priority and the lowest timeout across the teams. Blocked outranks High in this merge, so a single blocking team is decisive; among non-blocked teams, the most-permissive priority and the strictest timeout win. The Source column names the team whose value was selected. (A user’s own row still beats any team value — see Resolution Precedence.)

Teams

The team detail page exposes both the Interactive and Machine / Agent class blocks. Whatever you configure on a team applies to every member of that team.

What’s specific to teams:

• Configuration applies to every member. A Logs override on the oncall team gives every member of oncall the same Logs budget. Members can still override the team’s value on their own user detail page if they need something more specific.
• Source label. Rows owned by the team show Source = group override (<stream>) on the team’s own page. The same row appears as team "<team>" (<stream>) on each member’s user detail page.
• Same shape as the user page. The Interactive and Machine / Agent blocks render exactly like the user page — wildcard rows on top, per-stream overrides under the disclosure.

Service Accounts

The service-account detail page exposes the Machine / Agent class block only. Service accounts never run interactive traffic, so the Interactive block is intentionally absent.

What’s specific to service accounts:

• Machine / Agent class only. Bearer-token traffic from the service account always classifies as Machine / Agent — there is no Interactive class to configure.
• No team inheritance. Service accounts don’t belong to teams, so their per-stream overrides table never shows team-inherited rows.
• Source label. Rows owned by the service account show Source = SA override (<stream>).

The Query Priority Section

Every entity detail page exposes a Query priority section with one block per applicable class. Each block matches the layout of the Global query priorities page, with one important difference: the Effective and Source columns reflect what this entity will resolve to, including any team-inherited or class-default values that fill in fields the entity hasn’t set itself.

1. Class header — Interactive or Machine / Agent.
2. Priority (all streams) and Timeout (all streams) — the entity’s own wildcard row. (unset / use default) means "I don’t have my own value; resolve from the next level of the chain."
3. Effective — what the resolution chain produces given the entity’s own row, any inherited team rows, and the cluster default.
4. Source — which step in the chain produced the effective value. Common values: class default (), user override (apm), group override (logs), team "oncall" (apm), SA override (**).
5. Per-stream overrides disclosure — surfaces stream-specific entries that override the wildcard row, including team-inherited rows for users (see Users above).

Set a Wildcard Override

The wildcard row is the most common entry point — it overrides the cluster default for every stream the entity uses.

1. Open the entity’s detail page ( Admin → Users / Teams / Service Accounts → ).

2. Locate the Query priority section and the class block you want to change.

3. In the Priority (all streams) drop-down, pick High, Medium, Low, Blocked, or (unset / use default) to clear. Blocked rejects every request the entity makes for this (class, stream) with HTTP 403 — see The Blocked Sentinel.

4. In the Timeout (all streams) field, enter a timeout in seconds, or leave blank to clear.

5. The Effective and Source columns update live so you can see what will actually be sent to Pinot.

6. Click Save at the top right of the class block.

Add a Per-Stream Override

Per-stream overrides on an entity detail page work the same as on the Global query priorities page.

1. Expand the Per-stream overrides disclosure.
2. Click + Add per-stream override and select a stream.
3. Set the Priority and Timeout for that stream. You can leave one or both blank to inherit from the wildcard or higher up the chain.
4. Click Save at the top right of the class block.

A common pattern is to set the wildcard to Medium / 60s and add a Logs override at Low / 120s — quick metrics queries stay snappy, while long-tail log scans get more headroom.

Remove an Override

Removing an entity’s own row falls the resolution back to the next source in the chain — usually the cluster default, or a team-inherited row for users.

Wildcard

1. Set Priority (all streams) to (unset / use default).
2. Clear the Timeout (all streams) field.
3. Click Save.

Per-Stream

1. Expand the Per-stream overrides disclosure.
2. Click the (×) icon on the row.
3. Click Save.

If the row was team-inherited (the user has no own row, only an inherited display), the × button is a no-op — there’s nothing of the user’s to remove. Edit the team instead.

Examples

Give the Oncall Team Faster Log Queries

1. Admin → Teams → oncall.
2. In the Query priority section, expand Per-stream overrides under the Interactive block.
3. Add a Logs override: Priority = High, Timeout = 120.
4. Save.

Throttle a Single Heavy-Hitter User

1. Admin → Users → noisy@example.com.
2. In the Query priority section, set Interactive Priority (all streams) to Low and Timeout (all streams) to 30.
3. Save.

Give a Nightly-Export Service Account More Headroom

1. Admin → Service Accounts → nightly-exporter.
2. In the Machine / Agent class block, set Timeout (all streams) to 600.
3. Save.