Your points made sense, only that I was clarifying that the web service does indeed restrict what the client can/cannot do to the database i.e I'm considering h

Your points made sense, only that I was clarifying that the web service does indeed restrict what the client can/cannot do to the database i.e I'm considering having the clients just make calls to the web service which in turn does the SQL queries vs the clients having credentials for logging into the SQL server and actually running SQL queries.