Of course _requirements_ are complicated and hard to get right: in general. So we learn and apply requirements patterns and software architectural plans to get a handle on that complexity, to control it. Your example of user access is an excellent one: and how to deal with it depends on domain design decisions (what is a user? what attributes do they have at various layers of the system?). My point, though, is that a framework architecture (i.e. the DBMS) that potentially cross-cuts so many layers has the potential to get wired-up in all those decisions you try to make, and can therefore easily blur the layers of abstraction. (Imagine a machine whose instruction set depended on the spelling of your name.) And my suggestion is: perhaps there are typical patterns of use (I called them “profiles”) which, once recognized, could be hardened in different ways. This discussion was about security, after all.

The thing about securing databases is that we must prevent illegitimate access, while permitting legitimate access. The complexity is not in the database, it’s in the definition of illegitimate vs. legitimate. In real-world scenarios, this distinction is complex and full of fine-grained special cases.

For instance, I want to allow users access to their own account details. But I don’t want users to access each other’s account details. Unless the user is an administrator. Or a merchant, in which case they should be able to access certain information about the user, such as her shipping address. But only if that user has authorized the merchant by ordering something from him. But that authorization is time-limited. Unless that user is a repeat customer of that merchant. Except when either the user or the merchant have blacklisted the other, because they had some bad transaction in the past.

The possible exception cases go on and on! Trying to block every case that needs to be blocked, while preserving access in cases that need access is hard. It’s not because the technology itself is complex. It’s because the real-world processes that we’re trying to model are complex.