What is the absolute client permission needed to receive Unix commands?

The ARD error "This task is not authorized on (computerName)" is forcing me to allow almost all the privileges in the Remote Management section of client computer's Sharing System Preferences. I've already had to add:

• "open and quit applications"
• "change settings"
• "delete and replace items"
• "restart and shutdown" (see this Apple document's suggestion for Unix commands)
• "copy items"

It makes no sense to my why 'Generate reports' must also be added, but clicking it off makes the error return. I'm just triggering a Unix command that goes something like "echo 1" and runs as root on the one test computer (and potentially dozens, so it wouldn't be pretty changing settings in that many) If it helps, the ARD host is 10.6.7 with ARD 3.4 (installed via the App Store a couple weeks ago) and the clients are 10.4.11 and 10.5.8.

I'm preparing documentation for ARD and some clients installing our software will not warm to the idea of widening up the permissions footprint. Potentially dozens of computers will need to be retweaked, even if they wouldn't have to leave their seat.

We also will need to deploy a pkg installer, so some of those may need to remain checked, but ...

What is the absolute client permission needed to receive Unix commands?

Thanks