Which permissions must be granted to the Vault Service Account for this feature to work properly?