an issue with denying a column explicitly, is the end user cannot do a select * from a table (nor an application) using that person's credentials.
it can make data access quite a bit more challenging.
any query that selects that column in it will fail(ie select col1,col2,col3 from table)
where col3 is explicitly denied.
the code has to explicitly select the columns that are accessible.
Lowell