OME & iDRAC least privilege account permissions

Hi all, 

What are the least iDRAC User Privileges we can grant to an iDRAC user account to enable OME to perform inventory?

To me it doesnt make sense the WS-Man account has the ability to do things like power cycle the hardware. 

Thanks.