Execute service permission on the EncryptPropertyValue service in the Encryption Services resource.
Visibility to the DatabaseThing Thing Package.
Typically to track down permissions issue, the most convenient and easy way is to use browser developer tools. For example in Chrome, developer tools can be used to view the API calls being sent by Composer, and the errors sent in response. ThingWorx Composer doesn’t expose Thing Packages, so in order to set visibility to the DatabaseThing Thing Package, one would need to throw a REST API call at it.
Hope this information helps in setting up a non-administrator own MSSQL database thing!