In the manual, state which standard roles the service account must have to work correctly, as well as the specific permissions required, for creating even more specific custom roles.