It is said that you should not give direct table access (even select permission) to a user or group. But with the new ORM tools like N-Hybernate what do we do? N-Hybrbate is not designed for Stored Proc access. They are not even planning to have Stored proc support. So do we DBAs allow access to tables? or should we fight it out? It is a tough place to be.It removes one level of security. It also makes it harder for a DBA to know before hand how much of an impact the application will have on the Database when it is released.

I did find one way to do it. Create Views and give access to Views for the user. That means we could restrict how much data the application user an see. Still they have indirect table access.

Has anyone else figured out a better solution for this? I am sure almost all DBA's face this issue.