Hi,
I'm trying to set up a login and a database, in order that :
* The login can do anything inside its database, except dropping it or using
'dangerous' sql commands
* Once logged using Management Studio, express or not, the login can see its
database only (select * from sysdatabases should return only one database)

I've checked MS hosting white papers.
I've tryed 2 differents configurations without full success.
Lastly I thought I could change the sys.databases view for my needs, but it
seems it can't be modified...

The hosting security white paper says you just add a user with this login in
one database and make him db_owner.
I tryed, it don't work: the database does not appear in "select * from
sys.databases" (nor in Management Studio browser)

One blog post says you just have to set the database owner to the login.
I tryed, the database appears correctly in the browser, but the login can do
any dangerous operations ... (changing database files locations, dropping
its database,  ...).
Also the "sa" login appears in Management Studio, along with master and
tempdb ... (probably because it is required). So what's the need to change
the admin login name from sa to anything else as stated in the security
white paper if it is still displayed to every customers ?????

Any solution from my main question ?

Thanks,
Benjamin.