We already went through this. At the beginning it was some trial and error to identify the permissions we needed for all our recipes, but with a bit of patience we finally figure it out. I would suggest to break it down into groups. Try and identify recipes that interact with the same objects and would require similar permissions, assign them to the new connection, play with permissions of the new role until they work, then move to the next group. Repeat until done.
