I see you already have some good advice. My 2 cents is to try to educate your managers about how a well designed database can be both effecient, functional and still be quite secure. Our managers and security officer can be fairly draconian, but I must admit, yours are the first to 1-up our managers.