I have a user who has been granted db_datareader in a database and nothing more. She is reported to be able to use Studio to right-click on an object (table, proc) and view the DDL. I have not verified this. Have I been operating
under a misconception? The user should not be able to do this. Please help me understand this.
↧