Permissions Hierarchy - GRANT on logins/users/roles

A question on the permissions hierarchy:

Since logins, database users, and database roles are both principals and securables - what does it mean to GRANT permission on a login/user/role to another principal? Does it mean that for a login - you can GRANT permission to EXECUTE AS that login or modify it, for example?

Thanks!

Yes, you can grant IMPERSONATE to execute as that principal or ALTER/CONTROL to allow its modification.

Laurentiu|||Thanks again!

permissions hierarchy

Hi,
With Yukon the permissions which are applicable to a securable can also
be applied at parent level. In case of database the permissions are
applicable to all schemas, all objects in that schemas. On the database
permissions tab there are two permissions 'Alter' & 'Alter any schema'. I
guess this is to allow just the 'alter' on schema but not ont all other
types e.g. assemblies. But then why not 'control any schema'
Thanks.
AjeyPlease post Yukon/SQL Server 2005 questions to the beta newsgroup for Yukon.
Cindy Gross, MCDBA, MCSE
http://cindygross.tripod.com
This posting is provided "AS IS" with no warranties, and confers no rights.