• I don't think that's true. You don't need to grant a user rights to a table, if the table owner and the stored procedure owner are the same.

    I need to get another instance set up (somehow out of sorts with 4 machines all semi-working here), and test this. I wonder if you have

    MyUser owns a table.

    A procedure to update the table is created by MyClient and set to Execute as MyUser.

    Can anyone with rights to the proc execute it and update the table?

    Trying to build a nice framework is a good idea, however what you are proposing could potentially cause security issues with some procs. The key is often to ensure that your table and objects fall under the same schema, in which case permission chaining should apply.