Thanks for the article. I use WITH EXECUTE AS quite a bit in our environment but gained an appreciation for using it to secure encrypted resources.

I do have one question, however. The application user is only granted select and execute permissions to the schema. What is it about permissions / ownership chaining that allows the application user to execute dbo.getEncryptionWithExecute WITH EXECUTE AS 'EncryptionUser' without knowing the password for the encryption user? Can I presume it's because all the objects are owned by dbo? Any security considerations that I should be aware of?

Thanks,

Andre