Hacker News Reader

Better yet, require that all applications call through some common API (such as a library or web service) to access the data.

Why not put that API inside the database (i.e. stored procedures and views)?

You can require this, but its tricky to enforce. Especially on DBAs.