> No, that's not right. The statements should be checked by the agent
> who tries to execute it.

I would add ".. unless another agent is specified."

I believe that it is quite common that one can specify a principal,
under which the call is executed (see for example createProcessAsUser
call in Windows). However such feature should require new grant:

GRANT UPGRADE PERMISSION [ON PROCEDURE <proc name>] TO {<object> |
<userList>}

Initially this permission is granted to the database owner, but he can
delegate it to any user by using WITH GRANT OPTION modifier.

Do we want this feature? Personally I see no need in it, but that's
another issue.

Roman