Permission are applied to entries in the sysusers table and stored in the sysprotectstable of the current database. Analogous to NT Groups, except for the fact that a member of any role can add other users to same role. Like NT groups, users can be members of multiple roles and roles can be nested. Manage disk files. Every DB has a public role.
All users are members.
Can't be removed. If you don't have permission to manage Windows NT Accounts Application Roles Used to restrict access to database through an application. Scope of role is the database. Application roles have no members. Password required for activation application role.