You're describing the "R" in CRUD, my friend: https://en.wikipedia.org/wiki/Create,_read,_update_and_delet...

In the example above, the select statements were inside stored procedures, and applications were only granted permissions to execute those with appropriate parameters.