> If you've got the same postgres wrapped in a more rigid validation then arguably there are more bugs that need to align for a mishap.

> The reality is people probably tend to skimp on the postgres layer's security if they're burying it deep under other things.

so the reality is, they don't have layers. they'll have one security layer.

best to put it in postgres, where other folks who aren't in a hurry to deploy the feature your boss wants, have tested the security model.