Processing account and extensions requires certain permissions, different for each functionality. The permissions are listed so that each next includes the previous:
1. Retrieving account and extension data requires the "ReadAccounts" permission.
2. Modifying extension settings requires the "EditExtensions" permission.
3. Modifying account (including creating, modifying and deletion of extensions) requires the "EditAccounts" permission.
4. Creating new accounts requires the "Accounts" permission.