that's an interesting idea. i do have write permission in the DBs. so I need to setup the source DB on my server as an external schema, right? This would solve the problem of pushing that whitelist to the source server.

is there some way I dont know about to do an executeSQL-type select in ETL instead of RemoteQueryTransformStep (which seems to require schema/query)? This is marginally preferable since the query definition would live on the destination server, in code, rather than my defining/saving SQL through the UI on the source server.