Re: security - assuming your RDBMS supports row-level security then you should be fine as-is - otherwise let users only query VIEW objects with security filters baked-in to them.