Great question! This is where other DaaS's have struggled and this is where we shine. The authorization model is robust enough that you can obviate a lot of the business-logic layer.

Building a sports site and only friends of team members or the team members themselves can message each other? Build it in your authorization model. The UI will only see appropriate recipients and only be able to send messages to them. In other words, a lot of your architecture could become UI-DB direct and only a portion going through a business layer.