The watcher and publisher projects should document the minimum required permissions needed for the service accounts that are used.