I'm wonder about best approach of implementation auth. rules in Client-Server app using Business Objects.

I've noticed common tactic is:
- on DB side: implement one role for application, used for all app's users
- definition users right and roles and assign users to proper group
- Client side: add to Business Object's getters/setters rights checker allowing write / display data for particular user

My concern is if this is really good approach from security perspective.
It looks DB sends all information to Client, and then client's logic decide what to display or not.
So, potentially advanced user can make query from their box and see/change anything. Isn't it?