仅允许用户执行指定存储过程的权限配置异常排查

我需要实现如下权限控制：用户仅拥有执行指定主存储过程（示例为lowlevel.ZipFile）的权限，执行主存储过程时，其调用的嵌套存储过程可正常运行，但用户不得直接执行嵌套存储过程。

我尝试通过创建新架构、为主存储过程设置WITH EXECUTE AS指定拥有嵌套存储过程权限的用户来实现，但执行主存储过程时却出现权限拒绝错误：
The EXECUTE permission was denied on the object '___ZipFile', database 'master', schema 'dbo'

以下为测试代码，若你的环境中存在名为SiteDatabase44的数据库、LowLevelUser_Executor的用户或master库中的___ZipFile存储过程，请留意。末尾附有清理脚本：

SET NOCOUNT ON
USE master;

IF NOT EXISTS(SELECT 1 FROM sys.databases WHERE Name = 'SiteDatabase44') 
    EXECUTE('CREATE DATABASE SiteDatabase44')

IF NOT EXISTS (SELECT 1 FROM sys.syslogins WHERE NAME = 'LowLevelUser_Executor')
BEGIN
    CREATE LOGIN [LowLevelUser_Executor] WITH PASSWORD = N'ShouldNeverBeLoggedInAs_asdasd', CHECK_POLICY = OFF;
    GRANT CONNECT SQL TO [LowLevelUser_Executor]
END
GO

CREATE OR ALTER PROCEDURE dbo.___ZipFile
    @Filepath varchar(500) NULL
AS 
    SELECT 22
GO
IF NOT EXISTS(SELECT 1 FROM sys.sysusers WHERE name = 'LowLevelUser_Executor')
    CREATE USER LowLevelUser_Executor FOR LOGIN LowLevelUser_Executor WITH DEFAULT_SCHEMA = dbo

GRANT EXECUTE ON [dbo].___ZipFile TO [LowLevelUser_Executor]

USE [SiteDatabase44];

IF NOT EXISTS(SELECT 1 FROM sys.schemas WHERE [name] = 'lowlevel') 
    EXECUTE('CREATE SCHEMA lowlevel')
GO
IF NOT EXISTS(SELECT 1 FROM sys.sysusers WHERE name = 'LowLevelUser_Executor')
    CREATE USER [LowLevelUser_Executor] FOR LOGIN [LowLevelUser_Executor] WITH DEFAULT_SCHEMA = dbo
GO
CREATE OR ALTER PROCEDURE lowlevel.ZipFile
    @Filepath varchar(500) NULL
WITH EXECUTE AS 'LowLevelUser_Executor'
AS 
    SELECT 'Zipping file...'
    EXECUTE master.dbo.___ZipFile @Filepath
GO

GRANT SELECT, EXECUTE ON SCHEMA::lowlevel TO [LowLevelUser_Executor] WITH GRANT OPTION;

EXECUTE AS LOGIN = 'LowLevelUser_Executor'
exec master.dbo.___ZipFile @Filepath = '' -- Works as expected
EXECUTE [lowlevel].ZipFile @Filepath = '' -- Doesn't work? Get's this error: The EXECUTE permission was denied on the object '___ZipFile', database 'master', schema 'dbo'.

go
REVERT;

清理脚本 #

USE MASTER;
DROP DATABASE SiteDatabase44
GO
DROP PROCEDURE dbo.___ZipFile
GO
DROP USER [LowLevelUser_Executor]
GO
DROP LOGIN [LowLevelUser_Executor]

内容的提问来源于stack exchange，提问作者Soerman