SSIS 2012: What rights are needed to connect to SSDB via DMO
The answer is contained in http://blogs.msdn.com/b/mattm/archive/2012/03/20/ssis-catalog-access-control-tips.aspx


  1.To allow a login to be able to read/execute only one project, but not able to access other objects (projects or environments) in a
  folder where the project is in: a.Map it to a member of the SSISDB
  database role -- public. (This leverages SQL security mechanism.) 
  b.Grant it Read to the folder, and grant it Read/Execute to the
  project. (This uses SSIS Catalog security mechanism.)
  
  2.To allow a login (user or group) to be able to read/execute all projects in a folder: a.Map it to a member of the SSISDB database role
  -- public.  b.Grant it Read/Execute/Read Objects to the folder.
  
  3.To allow a login to be able to do anything on SSISDB: a.make it a member of the SSISDB database role -- ssis_admin.