iControl and Enterprise Manager Permissions

I am using the latest version of the iControl assembly (11.2) and (11.4.1) and ran into a permission issue trying to connect to our local Enterprise Manager. Here is the code with the sensitive information removed:

string enterpriseManager = "some server"; int port = 443; string userName = "some user name"; string password = "some password";

        Interfaces ic = new Interfaces();
        var test = ic.initialize(enterpriseManager, port, userName, password);
        string[] list = ic.ManagementEM.get_devices();
        foreach (string device in list)
        {
            Console.WriteLine(device);
        }
        Console.ReadKey();

the code gets to line "ic.ManagementEM.get_devices()" and fails with the following message: SoapHeaderException: Exception caught in Management::urn:iControl:Management/EM::get_devices() Exception: Common::OperationFailed primary_error_code : 17238050 (0x01070822) secondary_error_code : 0 error_string : 01070822:3: Access Denied: user (Svcdiscoverysrvcs) does not have access to action (change control administration)

Since we want to limit the permissions of the account that accesses enterprise manager, what is the lowest level of permissions that is needed in order to read the devices data in enterprise manager using the iControl assembly?

Any assistance would be greatly appreciated.