When do you need to apply permissions to a synonym

Question

I see from BOL that you can apply permissions to a T-SQL synonym, but in playing around with synonyms I'm not clear when you would need to do that if you have already GRANTed permissions to the base object.

eg. If I have a synonym in database A that points to a table FRED in database B, then it appears that as long as user Joe is granted SELECT on [Fred].[B] then Joe can do SELECT * FROM [Fred].[B].

Answer 1

Using Synonyms (Database Engine)

The following permission statements are associated only with the synonym and not the base object: (then mentions GRANT, REVOKE; DENY)

After that, ownership chaining applies.

When an object is accessed through a chain, SQL Server first compares the owner of the object to the owner of the calling object. This is the previous link in the chain. If both objects have the same owner, permissions on the referenced object are not evaluated.

CREATE SYNONYM dbo.FooBar FOR dbo.MyBaseProc
GO
GRANT EXECUTE ON dbo.FooBar TO MyUser
GO
REVOKE EXECUTE ON dbo.MyBaseProc TO MyUser
GO
EXEC AS USER = 'MyUser'
GO
PRINT '1'
EXEC dbo.MyBaseProc --fail
GO
PRINT '2'
EXEC dbo.bob    --pass
GO
REVERT
GO


DENY EXECUTE ON dbo.MyBaseProc TO MyUser
GO
PRINT '3'
EXEC AS USER = 'MyUser'
GO
EXEC dbo.bob    --pass, 'coz DENY aint checked...
GO
REVERT
GO

Edit: I hope I've answered your question...