Give access to data

A data source’s Access tab sets who can use it in Claude, ChatGPT, or another AI client. Admins can always use it. Bonnard refuses anyone else until you give them access. The sample data starts open to Everyone on the team. On a data source with tenancy, only customers can get it.

Requirements

• The Editor role or higher.
• A connected data source.

Who can get access

The PostHog integration takes people, groups, and Everyone on the team only.

Give access

1. In the console at app.bonnard.ai, select Data, then the data source.
2. Select the Access tab.
3. Search for people, groups, or customers, and select each one.
4. Select Add, for example Add 2.
5. Make sure that each name is in the list on the tab.

For all members or all customers, set Everyone on the team or All customers to on. Bonnard applies each change from the next call.

To take access away, select Remove on the row. To exclude one member, first set Everyone on the team to off.

An admin can invite a Viewer to a data source with no tenancy: type their email address in the search field.

Access on a data source with tenancy

On a data source with tenancy, the tab offers customers and All customers only. Admins keep access, and so do members who had it before tenancy was set. They get table structure only. An Editor or higher can use Preview as.

Each customer also needs a tenant, the value that marks its data in your database. Without one, its Status reads Needs an ID and its users get no data. Select Set ID in its row. The tab calls it Customer ID, and the Customers page Tenant ID.

On Database per customer, Needs a database means that no pattern names its database. Select Set it, or Import CSV with tenant_id and database columns.

One service account for each customer on BigQuery

With Dataset per customer, set on the Tenancy tab, Bonnard queries as each customer’s own service account, so grant each one only its own dataset.

1. On the Access tab, select Set up and copy the Google account it shows.
2. In Google Cloud, on each customer’s service account, give that Google account the Service Account Token Creator role.
3. Add the customer. If its Status reads Needs an ID, select Set ID first.
4. Select Set it in the customer’s row.
5. Enter the Dataset and Service account, then select Save and check.
6. Make sure that the customer’s Status reads Ready. If not, select the status for the fix.

For many customers, select Import CSV. The file holds up to 1,000 rows and needs tenant_id and service_account columns. An unknown tenant_id becomes a customer unless you clear the create checkbox. With no dataset pattern on the Tenancy tab, a row also needs dataset. The dialog shows each row it cannot import and saves nothing until you fix the file:

tenant_id,dataset,service_account
acme,customer_acme,acme-reader@your-project.iam.gserviceaccount.com

When someone has no access

A person with no data source gets this message in their AI client:

You don't have access to any data in <workspace> yet. Ask an admin or editor to give you access.

A customer’s user gets this message:

You don't have access to any data from <workspace> yet. Ask <workspace> to give you access.

To fix it, give the person or their customer access on the Access tab. Each refused call shows as denied on Activity.

Until set-up is done, a customer with access gets one of these:

<workspace> has not finished setting up your access. Ask them to complete it.
<workspace> hasn't set where your organization's data is yet. Ask them to complete it.
<workspace> must set up a separate database credential for each customer before your data can be shared here. Ask them to complete it.
<workspace> hasn't finished setting up how your organization's data is kept separate. Ask them to check it.

Select Set ID or Set it in the customer’s row. The last message means that the isolation check refuses customers.

Related

• Limit each customer to its own data: set how a data source keeps customers apart.
• Manage your team: invite members and create groups.