Give the limitations of SQL authorization.
The code for checking authorization becomes intermixed with the rest of the application code.
Implementing authorization by application code rather than specifying it declaratively in SQL makes it hard to make sure the absence of loopholes.