I'm going to open a separate issue for this as tracking down the minimal permission set could be quite tricky