--1. Database1 - tables read only.
    USE Database1
    CREATE ROLE [ReallyReadOnly] 
    --give reader writes to this group
    ALTER AUTHORIZATION ON SCHEMA::[db_datareader] TO [ReallyReadOnly]
    --explicitly DENY access to writing
    ALTER AUTHORIZATION ON SCHEMA::[DB_DenyDataWriter] TO [ReallyReadOnly]

--2. Database2 - GRANT Select / Insert / Delete data
    USE Database2
    CREATE ROLE [ProcWriter] 
    ALTER AUTHORIZATION ON SCHEMA::[db_datareader] TO [ProcWriter]
    ALTER AUTHORIZATION ON SCHEMA::[db_datawriter] TO [ProcWriter]
--3. Database2 - GRANT Create / Alter procedure (delete action not required)
    ALTER AUTHORIZATION ON SCHEMA::[db_ddladmin]   TO [ProcWriter]
--4. Database2 - Execute all procedure/functions
    --auto granted with datawriter?
--5. Database2 - User should not alter the table structure.
--loop thru all tables to "DENY ALTER ON [dbo].[eachtable] TO [ProcWriter]"