I actually wrote this post awhile ago on my blog and forgot to cross post this to the GP blog. Bad me…though I have updated it recently with new information!
Essentially its the minimum permissions you need to run AGPM without Domain Admins access given to the service account…
Hope this helps!
Michael Kleef, Program Manager, GP