The salary-from-total-cost example is the cleanest statement of this I have seen, and it generalises in the direction nobody wants: any aggregate plus a count is one division away from an individual value, and with a narrow enough filter the group size goes to one.

Two things follow. The enforcement point has to sit after the query plan is formed and before results are returned, because neither the natural-language layer nor the database can see the derivation on its own. And you need an explicit minimum group size policy, since "this user may see department totals" stops being true when the department has two people. That threshold is a product decision most organisations would rather leave implicit, which is precisely why it ends up unenforced.