Teams

Teams (/teams) group cost by organizational unit — engineering, platform, data — so you can see what each group spends without building custom tagging rules by hand. Under the hood, a team reserves a tag_value under the conventional team tag key: creating a team called “Platform” is the same mechanism as creating a cost tag rule that assigns spend to team = platform.

Creating a team manually

1. Go to Teams.
2. Click New team.
3. Enter a name.
4. Add members.
5. Save.

Creating a team this way does not, by itself, attribute any cost to it. To see spend under a team, you still need a cost tag rule that assigns some dimension (an AWS account, a GCP project, a service) to that team’s tag value. See Virtual tagging & cost allocation for how rules and split rules work.

Importing teams from your identity provider

If your account has directory sync configured (Okta, Entra ID, Google Workspace, or GitHub teams), Plutus reads the groups in your directory and suggests teams based on them.

Directory sync never creates a team automatically. A background job silently writing tag rules would change what a budget counts the moment someone edits a group upstream — adding or removing a member in Okta, for example — and that’s a change to your cost data that happened outside Plutus and outside your control. Suggestions require a person to review and accept them.

To act on a suggestion:

1. Go to Teams.
2. Review the Suggested teams list — each entry shows the directory group’s name and member count.
3. Accept to create a team from the suggestion, or Dismiss to ignore it.

A dismissed suggestion stays dismissed across future syncs. Dismissal is keyed on the group’s immutable ID from the identity provider, not its name, so renaming a group in your directory doesn’t bring back a suggestion you already dismissed.

What directory sync reads

Directory sync reads only each group’s name and member count. It never reads member identities — connecting an identity provider to populate Teams does not give Plutus a copy of your employee directory.

Teams are informational, not an access boundary

A team does not restrict what cost data its members can query. Adding someone to the “Platform” team does not limit them to Platform’s spend, and removing them from it does not hide any data they could previously see. Every member’s actual data access is governed by their account role (admin, member, viewer), not team membership.

For example, a viewer who isn’t on any team can still see every team’s spend on the Teams page. A member of the “Data” team can still query AWS costs that have nothing to do with Data’s tag rules. Teams answer “how is spend organized,” not “who can see what” — for the latter, see Security & access.

Team-scoped budgets

A budget can be scoped to a team, the same way it can be scoped to the whole account or to one cost source. A team-scoped budget watches the team’s tag value and alerts when spend against it crosses a threshold.

For example, a budget scoped to the “Platform” team with a $50,000 monthly threshold tracks the sum of every cost_entries row attributed to team = platform — through direct tag rules and through any split rule that assigns Platform a share of shared spend. It has no relationship to who is a member of the Platform team; it only reads what’s tagged to that team’s tag value.

See Budgets & alerts for how budget scoping and thresholds work in general.