Microsoft’s official Group Policy blog
I actually wrote this post awhile ago on my blog and forgot to cross post this to the GP blog. Bad me...though I have updated it recently with new information! :)
Essentially its the minimum permissions you need to run AGPM without Domain Admins access given to the service account...
Hope this helps!
Michael Kleef, Program Manager, GP