Database-level role names
from http://msdn.microsoft.com/en-us/library/ms189121(SQL.100).aspx
db_accessadmin
Members of the db_accessadmin fixed database role can add or remove access to the database for Windows logins, Windows groups, and SQL Server logins.
db_backupoperator
Members of the db_backupoperator fixed database role can back up the database.
db_datareader
Members of the db_datareader fixed database role can read all data from all user tables.
db_datawriter
Members of the db_datawriter fixed database role can add, delete, or change data in all user tables.
db_ddladmin
Members of the db_ddladmin fixed database role can run any Data Definition Language (DDL) command in a database.
db_denydatareader
Members of the db_denydatareader fixed database role cannot read any data in the user tables within a database.
db_denydatawriter
Members of the db_denydatawriter fixed database role cannot add, modify, or delete any data in the user tables within a database.
db_owner
Members of the db_owner fixed database role can perform all configuration and maintenance activities on the database, and can also drop the database.
db_securityadmin
Members of the db_securityadmin fixed database role can modify role membership and manage permissions. Adding principals to this role could enable unintended privilege escalation.
In theory, a user who can do nearly everything but modify access and security permissions:
