Inbox

The Inbox is your team's triage panel for spend anomalies, budget alerts, and setup tasks. It docks to the right side of the screen and is accessible from the bell icon in the top bar.

What is the Inbox?

The Inbox consolidates everything that needs a human decision: anomaly alerts, budget threshold breaches, one-time setup tasks, and cost optimisation opportunities. It is designed for triage — items are priority-sorted so you work through the most urgent things first, one at a time.

Open the Inbox by clicking the bell or inbox icon in the top navigation bar. The panel docks to the right side of the screen and can be closed without losing your place in the main view.

The count badge

A badge on the inbox icon shows the total number of items across all sections. The colour signals whether immediate action is needed:

Badge colour	Meaning
Red	One or more anomaly alerts are open and need attention.
Grey	No active anomalies — only opportunities or setup tasks remain.
No badge	All clear. Nothing requires action.

Inbox sections

The Inbox is divided into five sections. Each section is collapsed when empty so you only see what is relevant to you.

Section	Visible to	What appears here
For you	Everyone	Alerts explicitly assigned to you, or alerts on providers you own.
Escalated	Admins only	Owned alerts that have been open for more than 3 business days without resolution. Weekends are excluded from the count. Escalated items are marked with a shield icon.
Needs attention	Everyone	Unowned alerts that have not yet been assigned to anyone.
Set up	Everyone	One-time onboarding tasks: connect a provider, connect Slack, add a payment method, invite team members. Each item disappears automatically once the action is completed.
Opportunities	Varies (see below)	Providers with no budget set (visible to everyone) and providers with no owner assigned (visible to admins only).

Escalation timing.The 3-business-day escalation clock only runs on weekdays. An alert opened on Friday will not escalate until the following Wednesday, assuming no action is taken over the weekend.

Acting on an alert

Each alert card in the Inbox supports four actions:

Action	What it does
Assign	Route the alert to a teammate. Search by name or invite someone by email directly from the assign flow. Once assigned, the alert moves to that person's “For you” section.
Resolve	Mark the alert as handled. You can optionally add a note explaining what was done. Resolved alerts are removed from all inboxes and logged in the Tasks history.
Dismiss	Mark the alert as a false positive. Dismissing an alert teaches the anomaly detector so it is less likely to fire on the same pattern in the future.
Click the card	Opens the Data Explorer pre-filtered to the provider and service from the alert, so you can investigate the underlying spend directly.

Investigating an alert.Click the alert card body (not the action buttons) to jump straight into the Data Explorer with the relevant filters already applied. This is the fastest way to understand whether a spike is real or expected.

Inbox vs Tasks page

The Inbox and the Tasks page show the same underlying data, but are designed for different modes of work:

	Inbox	Tasks page
Purpose	Triage — work through one alert at a time	Full tabular list for bulk review and management
Sorting	Priority order (severity, then age)	User-configurable column sort
Layout	Side panel, overlays current page	Full-page table
Sync	Both views are live — resolving or assigning in one is immediately reflected in the other.

Use the Inbox for your daily triage routine. Switch to the Tasks page when you need to audit all open alerts, filter by service or severity, or get an overview of the team's workload.

Note.Actions taken in the Inbox (assign, resolve, dismiss) are always reflected on the Tasks page in real time, and vice versa.

Forecasting

Tasks