SQL 2008 permissions - cumulative or not?
I don't know how much you already know about the user and permission system in SQL Server. It is possible that you need to do some studying in order to fit all pieces together, to your liking.
Restore (which includes log shipping) gives you a binary copy of the database. This includes all users in the database with the assigned database level (and lower) permissions. Nothing you can do about this. Except for running post-restore scripts, but that seems undesirable and also impossible since it means breaking log shipping.
Then you have the instance level. This means logins. The only privilege at the instance level that &quot;trickle down&quot; to the database level is sysadmin (including CONTROL SERVER). This allow somebody to do everything, including SELECT, INSERT ect on all tables in all databases. There are of course other server level roles and server level assignable permissions, but those are more &quot;special things&quot;, and as far as I can see won't affect traditional object level privileges.
Permissions are cumulative. You have the sum of all privileges. But that excludes any DENY. DENY overrides all types of GRANT. (There is an exception with column level DENY, but my guess is that it won't affect you.) Well, except for sysadmin, DENY isn't checked for those who are sysadmin.
I've tried to follow your description to be more to the point, but I'm afraid I get a bit lost in the details. Perhaps above can get you started and you can get back with specifications or more precise questions?