Authorizations for WF-BATCH

[Robin Sahasranam]

Our Basis team is under a mandate to limit authorizations in Production,  to the
minimum needed, for all logins including WF-BATCH. They are especially cracking
down on use of the SAP_ALL profile which is assigned to WF_BATCH as per SAP's
recommendation. Has anybody faced a similar security mandate? What
profiles/authorizations would I need for WF-BATCH, if SAP_ALL is removed?
 
We are currently on 4.0B and migrating to 4.6C in a few months, so I am
interested in a solution which will work in both releases.
 
Thanks in advance for your help.
 
Robin Sahasranam
World Bank