# Control who can use your app

> An app's audience sets who can connect from Claude, ChatGPT or another AI client. Its database's tenancy limits the options.

Updated: 2026-10-12

To control who can use your app in Claude, ChatGPT or another AI client, set its audience. Bonnard refuses a connection from anyone outside
it, whichever AI client they use.

You choose the audience when you create an app, and change it on the app's **Overview** tab.

## Audience options

Table: Audience options

| Audience | Who can connect |
| --- | --- |
| **Internal** | Members of your workspace, whatever their role, signed in with their Bonnard account. No customer can. |
| **All customers** | Users of every customer on the **Customers** page, including customers you add later. |
| **Specific customers** | Users of the customers you select. A customer you add later is left out until you select it. |

New apps on a **No tenancy** database start on **Internal**, so you can try one before any customer sees it.

On the production URL, members of your workspace sign in to **Internal** apps only. They test the others on the
[staging URL](https://bonnard.ai/docs/apps/publish-and-staging.md). An admin's [personal API key](https://bonnard.ai/docs/apps/install-in-ai-clients.md#connect-a-script-with-an-api-key)
also works on an **All customers** app on a **No tenancy** database.

On a database with tenancy, each customer also needs a tenant (the value that marks its data in your database), set as
its **Tenant binding** on **Customers**. Without one, its users get no data. The **Audience** card warns when a customer
in the audience has none.

## Change the audience

1. In the console at `app.bonnard.ai`, open **Apps**, then your app.
2. On the **Overview** tab, choose an option in the **Audience** card.
3. For **Specific customers**, select each customer under **Customers**. **Select all** picks every current customer,
   and **Clear** empties the list.
4. Select **Save audience**.

[Image: The Overview tab of an app: the Endpoints card with the Staging and Production URLs, and the Audience card with Internal, All customers and Specific customers, set to Internal, and Save audience]

[Image: The Audience card on Specific customers, with the customers picker open: Search customers, two customers ticked, Select all and Clear]

The change reaches both URLs at once, published or not. Anyone it leaves out is refused from their next call.

With no customers yet, the card shows **No customers yet** and an **Add customer** button.

## Which audiences each database allows

The database's tenancy decides which options the **Audience** card offers.

Table: Audiences by database tenancy

| Database tenancy | Audiences offered | New apps start on |
| --- | --- | --- |
| **No tenancy**, any engine | Internal, All customers, Specific customers | Internal |
| **Multi-tenant (RLS)**: PostgreSQL, Redshift, SQL Server | All customers, Specific customers | All customers |
| **Schema per tenant**: PostgreSQL, Redshift. **Database per tenant**: ClickHouse, DuckDB / MotherDuck, MySQL / MariaDB, SQL Server | All customers | All customers |
| **Dataset per tenant**: BigQuery | Customer access, set per customer | Customer access |
| [PostHog](https://bonnard.ai/docs/connect-data/posthog.md) | Internal | Internal |

On a database with tenancy, every query runs as one customer, so **Internal** is not offered. Where one option is left,
the audience is locked to it.

## BigQuery with Dataset per tenant

Here a customer gets data only once you map it to a dataset. In the **Audience** card, under **Per-customer dataset
mapping**:

1. Select **+ Add customer** and pick a customer with a tenant binding.
2. Enter its dataset and service account, then select **Save audience**.
3. Select **Check credentials** to test the saved service accounts.

[Image: The Audience card of a BigQuery Dataset per tenant app: Internal and Customer access unavailable, and the per-customer dataset mapping with + Add customer, Import mappings CSV and Check credentials]

**Import mappings CSV** saves many rows at once and checks them. Bonnard publishes the app only once at least one
customer is mapped. Setting up the datasets: [BigQuery](https://bonnard.ai/docs/connect-data/bigquery.md).

## When someone is not in the audience

The app refuses the connection with `This MCP server is not available to you. Ask the server owner to add you to its audience.`
Each refusal shows as a denied call in Observability.

The **App access** column on **Customers** lists the published apps whose audience includes each customer.

## Related

- [Install in AI clients](https://bonnard.ai/docs/apps/install-in-ai-clients.md): add an app to Claude, ChatGPT or another client.
- [Publish and staging](https://bonnard.ai/docs/apps/publish-and-staging.md): the two URLs, and who can use each.