I actually like and use database security features. However, there are generally two problems with them: 1. There is a limit to the customization 2. They are g

I actually like and use database security features. However, there are generally two problems with them: 1. There is a limit to the customization 2. They are generally harder to test and change Application code is usually optimized for both points. So for me, I actually prefer a combination: use rough database security features to reduce the blast-radius of a bug in the application code. And use application code for everything else, since it's easy to customize, easy to understand, independent of the database technology and very easy to test.