In the interest of creating minimal permission sets for automated users, what are these for the cron user? If the cron is being run via drush, what are the minimum Civi permissions it can get away with? If a scheduled job requires permissions to execute (e.g., contact create) does the automated user need these too?
[This may seem like a pointless question: if there's a Cron User, and its credentials just live on the host machine, why would this be necessary? If they have the host machine, they have the host machine, right? Well, usernames can be guessed, passwords can be cracked over time, and best practice is best practice.]
