So it looks like for in house developed application and databases, all read and write to database should go through by using stored procedure instead of granting db reader and db writer role, correct?

Then grant execte to each procedure.

Thanks for clearing out for application logins it should keep minimum permissions like just excute stored procedures.

I also sometimes have to grant some developers dbowenr for some databases, for they not only need to read,write,execute, they sometimes do need to create ddls.

Thanks,