Yeah, you've pretty much nailed the reason for it existing. The only trick is, can you readily isolate individuals within your system to limit them logically. If so, it works great. If everyone comes in with the same login, or worse, they're all SA, you're in trouble. Or, if they all come in with the same login, everyone gets the same restrictions. However, it works. Yes.
"The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood"
- Theodore Roosevelt
Author of:
SQL Server Execution Plans
SQL Server Query Performance Tuning