I am using app roles on bank system.

If you are using “standard role”, users could use isql, excel, odbc etc. to change or see the data using the stored procedures...