> Security doesn't only have to happen at the app layer Agreed and once an application has differentiation between a “super user” and users of fewer privileges

> Security doesn't only have to happen at the app layer Agreed and once an application has differentiation between a “super user” and users of fewer privileges, it needs an application security model. Additionally once there are differences in which data a user may access, it needs a data security model.