I'd say that the new API-centric model works very well here. The old codger has complete control on what's coming and going from the core application, without w

I'd say that the new API-centric model works very well here. The old codger has complete control on what's coming and going from the core application, without worrying about a whippersnapper messing with the DAOs and adding a bobby tables vulnerability. In the Dark Past, this last line of defense was in stored procedures, but we -- 30-something greybeards :) -- know what a mess that was. There are plenty of companies who are still tied to an ancient DBMS due to that 10kLOC stored procedure that looked like a good idea at the time.