Right you are.
Maybe you can answer another question. I was thinking of using SQL Server application security but when I try to send the command to start using the application role I get a security error. It won't let me send commands to SQL Server - except the InfoPath connections that are used.
My other idea was to set up a user - give that user the needed access to SQL Server and control access in InfoPath itself. Does this sound like a reasonable idea?
Thanks