Using Synonyms (Database Engine)
The following permission statements
are associated only with the synonym
and not the base object: (then mentions GRANT, REVOKE; DENY)
After that, ownership chaining applies.
When an object is accessed through a
chain, SQL Server first compares the
owner of the object to the owner of
the calling object. This is the
previous link in the chain. If both
objects have the same owner,
permissions on the referenced object
are not evaluated.
CREATE SYNONYM dbo.FooBar FOR dbo.MyBaseProc
GO
GRANT EXECUTE ON dbo.FooBar TO MyUser
GO
REVOKE EXECUTE ON dbo.MyBaseProc TO MyUser
GO
EXEC AS USER = 'MyUser'
GO
PRINT '1'
EXEC dbo.MyBaseProc --fail
GO
PRINT '2'
EXEC dbo.bob --pass
GO
REVERT
GO
DENY EXECUTE ON dbo.MyBaseProc TO MyUser
GO
PRINT '3'
EXEC AS USER = 'MyUser'
GO
EXEC dbo.bob --pass, 'coz DENY aint checked...
GO
REVERT
GO
Edit: I hope I've answered your question...