Virtual tags

A virtual tag is a tag key LevelFour assigns to your cost from rules you set, beside the tags your providers report. Nothing changes in your cloud or in your tools. Use one to fix tags that disagree, or to map accounts, people or workloads to owners.

A provider tag covers what someone tagged. A virtual tag also reaches:

• Untagged resources. A rule can match an account, a service or a resource, so cost nobody tagged still gets a value.
• Shared costs. Split a support fee or a shared inference cluster between teams by percent, by what each team spends, or by the usage you send.
• Providers with no tags. A rule can match the account, the SKU or the person a connected tool bills, so a team's Claude Code and Cursor seats sit under one value.
• Past cost. A new tag can cover cost already billed, up to 12 months back.

A rule can read any provider you connect: a cloud bill, an AI tool such as Claude Code or Cursor, an observability or data platform, or a Kubernetes cluster. One tag can hold a team's database, its bucket, its pods and its developers' seats.

For cost allocation, read it in Breakdown, which groups cost by a virtual tag across every provider under Virtual Tag. The tag's own page lists what each value costs, and cards such as Cost by Tag on Boards can group by it. Where virtual tags show up has the other places.

This page covers the dashboard. The virtual tags guide explains how LevelFour picks a value and lists every dimension, and l4 tags keeps tags in YAML files.

Find your tags

Open Tags in the sidebar. The page lists every tag key your organization has:

• All tags, Virtual tags, Predefined or Provider tags, from the tabs at the top, and one provider at a time from the provider filter
• the key, its description, the providers it comes from, how many values and resources it has, and the spend it covers

The bar above the list compares Tagged spend with Untagged spend, across provider and virtual tags together.

Create a virtual tag

Fields you must fill carry a red asterisk, and the rest say (optional). You pick names and values from lists, and type only a name that does not exist yet.

You can leave four settings as the form opens them:

• Apply to past cost is on, from the earliest month offered, up to 12 months back. Cost already billed gets a value too. LevelFour reprocesses those months in the background, and the tag's page shows progress until the figures update. Turned off, only new cost does.
• Your rules win over the provider's tag applies only to a key named like one your providers report. Off, their value stays wherever they set one, and your configurations fill in the rest. On, your configurations decide.
• Name for unallocated cost is what this tag calls cost no configuration claims. Left empty, it reads Unallocated. Name the unallocated line has the rules.
• Provider tags to reuse copies the value of tags your providers already report, such as env and Environment. They are checked in order before the configurations, and the first one a cost carries gives its value.

Predefined tags

LevelFour keeps 19 tags in every organization, marked Predefined. You do not create them and cannot edit them. They answer common questions about a bill before you write a rule. Each is one rule, and spend the rule cannot answer lands on the tag's own unallocated line, named in the last column.

The six AI tags (Model Name through Token Type) read only AI lines, so their values add up to AI Spend. Which provider answers which field is in the guide's AI taxonomy tables.

Predefined tags work like any other tag in Breakdown, Boards and the API. They differ in four ways:

• Read only. LevelFour refuses a write to one. Click Duplicate to get a copy you can edit.
• History starts three months back. A predefined tag has no values before that.
• Outside your limits. They do not count toward the 50 virtual tags an organization can hold, toward Tagged spend, or toward the resources a tag carries.
• Kept current by LevelFour. LevelFour fills them in for a new organization and whenever a model table changes, with no action from you.

A predefined tag whose name a provider tag of yours already uses reads AI Spend (LevelFour) and so on, because a virtual tag hides the provider tag of the same name.

Take a value from a key

Value from a key makes the value come from the cost line itself. Pick the key in the same pickers a condition uses: a dimension such as Account name, a provider tag, or another virtual tag.

An example: a tag Owner with one configuration, Value from a key set to the dimension Account name. Every line on the account payments-prod gets the value payments-prod, with no rule written per account. A new account shows up as a new value on its own.

A line with no value under that key falls through to the next configuration, so it is not lost. Put a Value from a key configuration near the end of a tag as a catch-all, or first when it should win. Resource cannot be the key.

Rules on any provider

The dimensions a condition offers follow the providers its rule reads. Every provider has Account, Region, Resource, Tag and Virtual tag. A connected tool adds SKU, the model, plan or meter a line names, and Person where it bills people one by one. The guide's dimensions section lists which provider reports which one.

A team's Claude Code and Cursor seats. The value is Payments. Its rule reads Anthropic, which reports Claude Code, and Cursor, where Person is the team's members, ticked from the list of people those tools bill:

Payments
  from Anthropic, Cursor
  where Person is ana@example.com, joao@example.com, lena@example.com

A database on AWS. The value is Checkout. Its rule reads AWS, where Service is Amazon Relational Database Service and Resource is the database, picked from the resources your bill names:

Checkout
  from AWS
  where Service is Amazon Relational Database Service
    and Resource is arn:aws:rds:us-east-1:111122223333:db:checkout-prod

A second rule in the same configuration, reading Kubernetes where Namespace is checkout, puts the service's pods under the same value.

Kubernetes in a tag

This works for Amazon EKS clusters that run the LevelFour agent. A cluster without the agent has no workloads to read.

One tag value can hold a service's pods in Kubernetes and the cloud resources it uses, such as its database and its bucket, so you budget the service as a whole.

A rule can name Kubernetes as its provider. Its conditions then read workloads:

A provider tag to reuse can name Kubernetes too. To group by the same key on both sides, reuse your cloud tag app and the pod label app in one virtual tag app: a cost carrying either supplies the value.

Kubernetes has no bill of its own, so LevelFour does not add the pods' cost on top of the bill. It splits each node's own bill lines (its compute, the volumes its pods claim, and the data transfer its pods send) across the values its workloads get, by what each workload cost on that node that day. The node's cost counts once, under the values of the pods that ran on it. The rest of each line (its idle capacity, the traffic no pod sent, and pods no Kubernetes rule matches) goes through the tag's other rules as before.

A tag only does this when one of its rules, or a provider tag it reuses, names Kubernetes. Every other tag reads node costs as it always did.

A tag whose rules match clusters and namespaces works as an allocation group: a value such as payments can hold the payments namespace of every cluster. The Kubernetes cost views group by it too.

The last day or two can still move: a day reads its node lines through the tag's other rules until LevelFour has priced the cluster's pods for that day.

A tag that names Kubernetes cannot sit inside another tag's rule on a cloud provider. On a node line, that rule would read the line's own tags instead of its workloads'.

Name the unallocated line

Cost no configuration claims reads Unallocated in Breakdown and Boards. To call it something else, such as Shared platform, fill Name for unallocated cost on the form, or later under Edit tag.

The name changes the label and no figure, and nothing is reprocessed. It cannot match one of the tag's values, and a value cannot be renamed to it. APIs still return the line as __unallocated__, with the name beside it.

Duplicate a tag

Duplicate copies a tag into a new one you own, from the tag's row actions or its page. The copy is named Copy of and the original's name, and you can rename it at once. It assigns the same spend as the original, and a predefined tag duplicates the same way.

A copy cannot start earlier than a new tag may, so a source whose history reaches further back starts the copy at the oldest month a new tag can. A tag named like a provider key reads that provider key by name, which a new name would lose, so the copy spells the provider key out as a rule. Duplicating takes the Member or Admin role and counts toward the 50 virtual tag limit.

Change notifications

Every change to a tag (created, duplicated, edited, a value renamed, deleted) is announced after it saves:

• the person who created the tag gets an in-app notification, unless they made the change. A tag created through an API key has nobody to tell
• the virtual_tag.changed webhook event goes to every endpoint subscribed to it, whoever made the change

Predefined tags announce nothing. The webhook payload is in the guide.

Edit a virtual tag

Open the tag from the list. Its page shows the values it assigns, the provider tags it reuses, its configurations in priority order, and the resources that carry it.

• Edit tag changes the key name, the description, the first month under Apply to past cost, Your rules win over the provider's tag and Name for unallocated cost. A new first month or override reprocesses the tag. A tag in a relation keeps both.
• Edit provider tags changes the provider tags it reuses.
• Each configuration can be edited, reordered or deleted. Cost a deleted configuration matched falls through to the next one once the tag is reprocessed.
• A value can be renamed from the Values list.
• Delete key removes the tag and its configurations, and reports lose it. This cannot be undone.

If someone else changes the same tag while you are editing, your save is refused and the page shows their version. Check it and make your change again. Neither edit silently overwrites the other.

Provider tags open read only. They are managed at the provider. Predefined tags open read only too, with Duplicate in place of Edit tag.

Without the dashboard

Everything on this page also works over the MCP server, so an assistant such as Claude or Cursor can build and maintain a tag for you:

• list-tags, get-tag, get-tag-coverage and list-tag-resources read the tags you have, their values and the resources that carry them.
• list-tag-dimensions, list-tag-dimension-values and list-tag-resource-candidates offer the same lists the pickers show, read from your own bill, so a rule names values that exist.
• preview-virtual-tag tries rules before anything is saved.
• create-virtual-tag, update-virtual-tag and delete-virtual-tag take a whole tag. create-virtual-tag-config, update-virtual-tag-config, delete-virtual-tag-config and update-virtual-tag-config-order change one configuration.
• update-virtual-tag-settings renames a tag or changes its description, first month and override. update-virtual-tag-value renames a value, and update-virtual-tag-collapsing sets the provider tags it reuses.
• get-virtual-tag-job follows the reprocessing of past cost, and get-costs-by-tag reads spend per value, for every provider at once with provider=all.
• create-virtual-tag-copy duplicates a tag, a predefined one included. update-virtual-tag-settings also sets the unallocated name.
• update-virtual-tag-telemetry and list-virtual-tag-telemetry send and list usage datasets. create-virtual-tag-relation, get-virtual-tag-relation-costs and delete-virtual-tag-relation work related tags.
• list-tag-category-candidates and the virtual_tag_setup prompt generate a tag by category. Generate a tag by category walks through it.

Tools has each tool's parameters.

Where virtual tags show up

A saved virtual tag works where a provider tag does. Breakdown groups by it under Virtual Tag, cards such as Cost by Tag on Boards can group by it, and so can the Kubernetes cost views for a tag with Kubernetes rules. The API, the CLI and the MCP server read it too. The guide's Where virtual keys appear lists every place.

Who can change tags

Everyone in the organization can read tags. Creating, editing and deleting a virtual tag takes the Member or Admin role.

Next

• Virtual tags guide has the rule patterns: splitting a shared account, applying a tag to past cost, nesting one tag in another
• l4 tags keeps the same tags in files you apply from a terminal
• Breakdown is where you read cost grouped by a tag