We mention some permissions required currently, but it should be more explicit for each binding which roles/permissions are required.
This should also make clear what ones are actually required and what ones are technically optional (for example trigger bindings only need CREATE permissions if the schema/tables don't exist so someone could go make those with a different login and the trigger would still run fine)