Teams (beta)

What Teams does

Teams lets a group of Koyd users pay for AI providers together and share resources under spending controls. You find it in Settings → Teams, marked Beta.

• Team providers: the team declares which providers it pays for, such as a company Anthropic or OpenRouter account. Requests through those providers count as team usage.
• Spending controls: a team budget, per-member caps, per-model limits, and a list of allowed models, checked on your device before each team request is sent.
• Shared resources: skills, agents, MCP servers, modes, prompts, swarm presets, and apps, which each member reviews and approves before they run.

Your other providers, sessions, chat history, files, and personal resources stay personal. Joining a team never overwrites them.

Storage your team owns

A team keeps its data in an Amazon S3 bucket or an Azure Blob Storage container that you control. These are the only supported services; other S3-compatible services such as Cloudflare R2, Backblaze B2, Wasabi, or MinIO do not work. Koyd never creates buckets or containers or changes their permissions. You do that in your provider’s console.

There is no Koyd-operated service in between. Each member’s own Koyd reads and writes the team’s storage directly, and team settings, policy, usage, and resources are never sent to Koyd. With Encrypt team data on, which is the default, team documents are encrypted before upload and the key stays on members’ devices. The storage provider can still see object names, sizes, and timestamps.

The team receives usage records for team requests (model, provider, token and request counts, cost, and time), your roster entry, resources you choose to publish, and audit events for team actions you take. Prompts, responses, files, and chat history are never shared.

Storage credentials and the team key live in a Teams vault protected by your system keychain. On a server without a keychain, such as a VPS, Koyd asks for a vault passphrase instead, and you enter it again after each restart. Team sync and team providers pause while the vault is locked; your other providers keep working.

Roles

• Owner: creates the team, controls its storage and credentials, and can transfer ownership to another member.
• Admin: chooses team providers and prices, sets the policy, invites and activates members, and reviews shared resources.
• Member: uses the team providers, approves shared resources on their own device, and can propose resources when the policy allows it.
• Viewer: can see the team but cannot use its team providers or publish resources.

Create a team

1. In your provider’s console, create a private bucket or container and choose an empty prefix for the team, such as teams/engineering/. Your own credentials need read, write, list, and delete access to it.
2. Open Settings → Teams and choose Create team. Pick the Storage provider, then enter Region and Bucket for Amazon S3, or Storage account and Container for Azure, plus the Prefix and your owner storage credentials. For Azure, a SAS token is safer than the storage account key.
3. Enter the Team name and Your display name. Leave Encrypt team data on unless you have a reason not to, then choose Create team.
4. Koyd tests the storage first. If something it needs is missing, such as conditional writes or a permission, it names the problem and creates nothing.

A new team starts in setup mode: a $0 budget, no team providers, and no allowed models. No team spending happens until an admin adds team providers and a policy.

Good to know · Keep a second admin joined with the team key, ideally on another machine. If every copy of the key is lost, the team’s encrypted data cannot be recovered, and key rotation is not available yet.

Invite and join

Each member needs their own storage credentials with only the access their role needs. In Grant templates, Generate template produces an IAM policy for Amazon S3 or a list of SAS grants for Azure. You apply it yourself in the provider console; Koyd never changes storage permissions.

An owner or admin sends the invite:

1. In Members, choose Add member, enter a display name, pick a Role, and choose Add and create invite.
2. Choose how long the invite lasts with Expires after, from 1 to 30 days. For an encrypted team, choose whether to Include the team encryption key. Copy the invite; it is shown only once.
3. Send the invite privately, the storage credentials separately, and your owner fingerprint over a third channel such as a call. To read it, choose Show my key fingerprint under Overview → Security.

The new member joins:

1. Open Settings → Teams, choose Join team, paste the whole invite, and choose Review invite.
2. Compare the Owner fingerprint with the one the owner gave you. If anything does not match, Koyd joins nothing.
3. Enter your storage credentials, and the team encryption key if the invite did not include it, then choose Join team.

Team providers stay unavailable until an admin chooses Mark active on the new member’s row. Next, the member connects the team’s providers with the company accounts the admin provides.

Team providers and cost modes

A team provider is one of the providers in Settings → Providers, such as Anthropic, GitHub Copilot, or OpenRouter. Every request a member sends through it counts as team usage and follows the team’s policy, whichever account they connected. Koyd cannot tell a company account from a personal one, so members connect the company account or key that an admin gives them.

Admins add them under Providers → Add team provider, with a display name and a Cost mode:

• API pricing: charged per token at Koyd’s built-in prices or a custom per-token price profile.
• Subscription: a flat seat that costs $0 per request. Spending still shows what the usage would cost at API prices when that is known.
• Premium requests: per-request multipliers, such as GitHub Copilot’s. Add a matching price profile in Pricing first.

Keep each provider in one team. If a provider belongs to two teams you joined, its requests are blocked unless the session uses shared resources from only one of them. While you are in a team, you cannot also use a personal account for one of its team providers through Koyd.

Budgets and limits

Admins set the rules in a team’s Policy tab and choose Save policy. Each member’s Koyd applies the new policy after its next sync.

• Team budget: a limit per billing period, set with Billing time zone and Period starts on day. Safety threshold (%), 95 by default, stops team requests before the budget to leave room for usage not yet synced. Warn at (%) sends warnings at 50, 75, and 90 by default.
• When the budget is reached: Block new team requests, the recommended choice, or Lockdown: allow only approved models. Lockdown is not a dollar ceiling, because the approved models keep spending.
• Member limits: money caps Per period, Per day, Per session, and Per request, plus Requests per day and Requests per period. Add override sets different limits for one member. A limit of 0 blocks.
• Model limits: Add model limit sets requests or spend per day or per period for chosen models, for all members, a group, or one member.
• Confirm requests estimated above ($): members confirm each larger request once with Confirm & continue. Confirming never bypasses a cap.
• Emergency freeze: Freeze team on the Overview stops new requests through every team provider for everyone until an admin chooses Unfreeze team.

Boosts raise a cap for a limited time, and exemptions remove named caps for a member or group. Both are recorded in the team’s audit log.

Allowed models and team-only providers

Nothing is allowed until an admin adds models. Use Allowed models and Denied models in the Policy tab, or the Allow switches under Providers → Models; both edit the same list. Entries take the form provider/model, or provider/* for every model of a provider, and a denied model always wins. Team requests to models without a known price are blocked by default.

Only allow team providers is off by default. While it is off, only team providers are governed, and your other providers stay personal: they are neither limited nor recorded. When it is on, requests through any other provider are blocked while you are in the team.

Sessions that use a team’s shared resources run only through that team’s providers, unless an admin turns on Allow team resources with non-team providers. That other usage is personal and is not uploaded to the team.

Know who pays

In the model picker, models of a team provider carry a Team: <name> label, and hovering it tells you which team pays and that its policy applies. Models without the label are personal. When a team turns on Only allow team providers, other providers’ models stay visible but are marked Not allowed by team. Koyd never moves a session to another payer; switching models is always your choice.

Koyd checks each team request before sending it, and a stopped request never reaches the provider. A banner above the message box explains why, for example a monthly limit, a model the team does not allow, or a frozen team. Depending on the reason, you can switch to one of the Allowed models, choose Confirm & continue, open the team’s resources, or start a new session without team resources.

Share reviewed resources

In a team’s Resources tab, Publish resources lets you pick skills, agents, MCP servers, modes, prompts, swarm presets, or apps and shows a sanitized Preview before anything uploads. Detected secrets block publishing, and MCP secrets become fields that each member fills in. Owners and admins publish directly; a member’s submission becomes a proposal that an owner or admin reviews.

Nothing shared runs until you approve it on your own device. Review shows each new or changed version with a diff, and Approve pins that exact version; a newer version never replaces it until you approve again. Approved items appear read-only in your usual lists with a Team: <name> badge. Items marked Required pause that team’s work, not your personal work, until you approve and set them up.

Spending, sync, and offline use

A team’s Overview shows your limits, the allowed models, and this period’s spending. Spending breaks usage down by model, provider, session, day, and more, and can export CSV or JSON. By default, members see only their own spending; admins can share team totals or everyone’s spending.

Koyd syncs with the team’s storage about once a minute by default. Offline, it keeps applying the last verified policy and queues usage until you reconnect. After the policy’s maximum age, at most 24 hours, the team’s offline rule applies; by default, team requests are then blocked. Azure SAS tokens expire: Koyd warns three days ahead, and an admin has to create a new token that you enter with Update credentials.

Leave team, on the Overview, removes the team’s credentials, key, policy, and approved resources from your device. Your provider connections, sessions, and settings stay as they are.

Limits to know

• Spending controls run on each member’s own Koyd instance. They prevent accidents in normal use, not deliberate misuse: a modified client or a company account used outside Koyd is not covered.
• Totals can lag, and requests already in flight can go past a limit. When members see only their own spending, team totals come from an owner’s or admin’s running Koyd and go stale while none is running.
• Keep the provider’s own enforced spending limits on every account the team pays for. Billing alerts in AWS, Azure, or Google Cloud only notify; they do not stop spending.
• A request that fails in transit can still count its estimated cost, because Koyd cannot prove the provider did not bill it.
• Every person needs their own Koyd instance. Pairing a teammate’s device to your instance gives them your access, not a separate account.
• Removing a member stops their team access at their next sync. Revoke their storage credentials and company provider access yourself; data and keys they already downloaded cannot be recalled.
• Teams is in beta and has not yet been certified against live Amazon S3 or Azure accounts. Try it with provider spending limits in place.