I have a table '[Employee]' , and I want to allow access to certain people only through [View] , using a grant.I am trying first to do it with a single user [User] and then do it for a collection of users through a role. I know I can use :
GRANT SELECT ON OBJECT : : [VIEW] TO [User] ;
And I can also create a role [Role] , and use:
GRANT SELECT ON OBJECT : : [VIEW] TO [Role]
My question is whether this permission somehow implicitly excludes all others, i.e., do the two grants above prevent any of the [Users][Roles] from having any other type of access to '[Employee]' ( Read, Select, Update ), or do I have to expressly prohibit said users, roles from having additional access?
I assume this has to see with membership of [User] and the people in [Role] in other logins or existing user types which may have been granted said permissions either explicitly or as part of role membership? Thanks.