I actually wrote this post awhile ago on my blog and forgot to cross post this to the GP blog. Bad me...though I have updated it recently with new information! :) Essentially its the minimum permissions you need to run AGPM without Domain Admins access