• ...and give you both credit...

    Not me. I don't deserve any credit. I actually do the DROP, *not* alter. I happily include permissions creation at the end of the script. I don't have any problem with that approach.

    I prefer writing up permissions at the bottom of every script. One thing you and I share in common is that I set it up so that I can re-create my databases (sans data) from scratch simply from scripts. This includes tables, procs, views, etc, and permissions. I can open any script file and know what permissions apply for that object. If I need to change permissions, I always do it through the script.