Bob, a user who is given an account on SQL Server, is a Securable.

Web Application 1 is using SQL Server to generate reports. Web Application 1 is a principal.

Table 1 on Instance 1 is a securable.

Web Application 1 is given read only actions on Table 1. This is a permission.