What is the permission needed to add permissions?
To change permissions within the restored database the account which the automation is using will need to be a member of the securityadmin fixed server role.  That'll give you rights to create a user within the database and give that user permissions within the database.

Using sp_change_users_login requires that the login which is running it be a member of the db_owners fixed database role within the database you are running it.