This is a fairly common theme in discussions about outages and production incidents. I'm surprised at this point with various SQL servers there's no simple ACL

This is a fairly common theme in discussions about outages and production incidents. I'm surprised at this point with various SQL servers there's no simple ACL to the effect of "can run UPDATE, but must include a WHERE clause" or "Can run UPDATE constrained to x rows, will error if more are selected". Obviously there are times where this will be intended but I think "UPDATE ALL ROWS" is a pretty rare requirement.