Ease of setup is definitely there, but what about optimizing all of these queries when there are large datasets? I imagine you would need to monitor usage, tune indexes and restrict the client from querying anything they want. What's are the recommendations on checking authorization against the data and preventing a possible DoS attack?