Human text is now untrusted code that is getting piped directly to evaluation. You would not let users run random SQL snippets against the production database,

Human text is now untrusted code that is getting piped directly to evaluation. You would not let users run random SQL snippets against the production database, but that is exactly what is happening now. Without ironclad permissions separations, going to be playing whack a mole.