That would work, except if S\AI is a member of any other Windows group that exists on the SQL server which has a DENY on ALTER, then he will still get the error.

You'd need to go through and find the permissions.

eg.

select *

from sys.database_permissions

where state <> 'G'