Application authorization for a database user

I was wondering if anyone has experience on controlling access to specific applications for an Oracle database user. Basically, I would like to allow a database user to access an Oracle database only through the specified application. The application can be arbitrary (an executable, jsp, etc), which cannot be transformed into a stored procedure. The application files may be located under an insecure client or middle-tier machine. An idea that I have is that I would store the app files to the database and build a dispatcher in the client machine to authenticate and download app files and launch it. It's basically building everything myself. A better idea? Thanks

--
Peter