aa363691_leged_Installation___Nik_Patel__2
[0] Service Application Pool Account(e.g. sp_serviceapps) [1] Specify this account as Service Application Pool while creating Service Applications like Managed Metadata, Search, User Profiles from Manage Service Applications page from Central Admin Application Pool identity to run the majority of the all the SharePoint 2010 Service Applications (WCF endpoint) as the IIS worker process (e.g. Managed Metadata Service and/or User Profile Service). Please note that both Service Application App Pool and Web Application App Pool Accounts behaves same. You can create more than 1 service account or group service accounts to isolate the IIS processes under services will run Log in to the SharePoint Server using farm account to configure service applications [3] None [4] None [5] Service Accounts in Central Admin Changes – This account is added as Service Application Pool Account for Service Applications in the Configure Service Accounts page. AD Group Membership Changes – After you create the SharePoint Service Application, following machine-level permission is configured automatically: Member in the WSS_WPG Member in the built-in IIS_IUSRS on IIS 7 (Windows Server 2008) and IIS 7.5 (Windows Server 2008 R2), IIS_IUSRs replaces earlier version built-in group, IIS_WPG SQL Database Changes – After you create the SharePoint Service Application, following SQL Server and database permissions for this account are configured automatically: Since this account is used as Service Application Pool for all service applications, it will be assigned to the db_owner role for the service application content databases (e.g. Managed Metadata, User Profile, Search DBs etc.) Never have access to the associated web application content databases. This account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the farm configuration database. This account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the SharePoint_Admin content database. [2] 
Must be Domain User Account. Must register as SharePoint Managed Account.
SharePoint 2010 Service Account References for Least-Privileged Installation | Nik Patel
2