You know as well as I do that a fitting class of shield isn ' t going to do any good against an engineered playerkiller . <| sep |> Don ' t forget that the permissions actually needed are probably different for every database the application runs on . As a DBA , I totally get that I should be the one to know what the DB level permissions are called and how to grant them for Microsoft vs MySQL vs PostgreSQL vs Oracle vs . . But come on now the application developer really should know if they are just reading data vs . actually changing it and what tables that is coming from instead of letting some magic ORM do the deed . I ' m convinced that it ' s the ORM layer that has perpetuated most of this I wish they didn ' t exist and it had to be understood by all parties instead of it just being a magic thing that ' s handled . ORMs are an antipattern ! offensiveantipattern . html