Service Roles

I have a service that keeps track of the employees within a department of a store:
Sales Department and Operation Department.


I have an application that allows only the Sales Manager to edit employees in the Sales Department and the Operations Manager to edit the employees in the Operation Department.
So the application will prevent the Sales Manager from editing an operation employee. But what prevents the Service from doing so? 


For instance, a new application could be written that allows this type of behavior. I guess my question is... should i be checking whether or not operations can be made on the SQL level?
For instance,


[psuedo sql code]

UPDATE user WHERE user is in sales department and I have sale management role.


You see what I am asking?


Another example to consider is the web app itself. The webapp could display all the users for me to edit. ...