Problem was that delegation was not constrained, which makes it even worse the oauth authorization sprawl we have now.

That ASP.NET application couldn’t just talk to MSSQL. It could do anything it liked that you had permission to do.