We created a Role (Alpha) and made it a member of the datareader Role.  Our
hope was that members of this role would only be able to preform data reads.

On a test we granted Alpha exec rights to an update Stored Procedure.  The
members of Alpha are now able to run the Stored Procedure and do updates even
thought they are NOT members of datawriter.  Further testing showed the same
for insert and delete stored procedures.

Does this sound right?

Thanks, Randy