Finding out what permissions are required by the SQL Server Agent Jobs I've been looking at this for a while and I can't work out an easy way to do this.

As it stands every job in the database runs under SA level rights (horrifying thought)

I'm sure some of the jobs need quite high level rights for what they're doing but I'm also certain quite a lot do not. I was thinking to create 3 or 5 domain accounts to better control the jobs (its not necessary but having them all run SA is personally worrying).

Anyone know a way that this can be done without simply ripping out all the permissions and granting them one by one until I stop getting errors?

Ste
The only way you'll be able to do this consistently and correctly is by looking at what each job does, and cross-referencing that with the msdn articles for each command on your given version.

For example, DBCC SHOW_STATISTICS has a section: 


  Permissions
  
  In order to view the statistics object, the user must own the table or
  the user must be a member of the sysadmin fixed server role, the
  db_owner fixed database role, or the db_ddladmin fixed database role.
  
  > SQL Server 2012 SP1 modifies the permission restrictions and allows
  users with SELECT permission to use this command.
  
  Note that the following requirements exist for SELECT permissions to
  be sufficient to run the command:   Users must have permissions on all
  columns in the statistics object   Users must have permission on all
  columns in a filter condition (if one exists)   The table cannot have
  a row-level security policy.
  To disable this behavior, use traceflag 9485.


As each command has a different subset of required permissions, and this is at times version dependent, there is no quick and dirty way to determine it that I know of.
(Maybe some tracing could give you the same information faster, but it would also imply monitoring the tasks as they run)