Accessing Table Data ONLY From View

Question

I have a table '[Employee]' , and I want to allow access to certain people only through [View] , using a grant.I am trying first to do it with a single user [User] and then do it for a collection of users through a role. I know I can use :

GRANT SELECT ON OBJECT : : [VIEW] TO [User] ;

And I can also create a role [Role] , and use:

GRANT SELECT ON OBJECT : : [VIEW] TO [Role]

My question is whether this permission somehow implicitly excludes all others, i.e., do the two grants above prevent any of the [Users][Roles] from having any other type of access to '[Employee]' ( Read, Select, Update ), or do I have to expressly prohibit said users, roles from having additional access?

I assume this has to see with membership of [User] and the people in [Role] in other logins or existing user types which may have been granted said permissions either explicitly or as part of role membership? Thanks.

Answer 1

Unless you grant SELECT to 'public' role, you must explicitly grant access to each user, group or database role.

For simplicity, you can create a new database role, (i.e. my_users), then grant select to this role and finally add new users to the role.