This isn't going o directly answer the permissions question, however, will explain how to do this in a more secure method.
The original method to interact with SOAP API used a plain text authentication:
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
This is somewhat insecure, and also takes up a user in your account.
With the newer method, you now can create an app in the Marketing Cloud "App Center" and authenticate against a REST authentication service, providing much better security.
You can read more about the process here - http://code.exacttarget.com/apis-sdks/soap-api/using-app-center-to-get-an-api-key.html
You will most likely just create an API Integration
API Integrations allow you to leverage the Marketing Cloud APIs. Create
an API Integration app when you want to use Fuel APIs to automate
tasks or integrate business systems. API Integration apps utilize an
OAuth2 client credentials flow to acquire access tokens directly from
the Fuel authentication service.
You would then use the following SOAP header (adding any required namespaces).
I have a post that explains the entire process in more detail here - http://kellyjandrews.com/using-fuel-oauth2-with-the-soap-api/