a login needs permission to
OPEN MASTER KEY
OPEN SYMMETRIC KEY
but it was denied but after researching gave the below permissions
CONTROL (grant CONTROL to user). now it is able to do the above two open.
but now it has CONTROL on whole database. is it possible to isolate or minimize its control to just the two elements (OPENs) and not the whole db?