In the example above, the select statements were inside stored procedures, and applications were only granted permissions to execute those with appropriate parameters.