When using a separate account for your agent connectivity credentials, there are no special permissions that need to be added in Active Directory or Windows. The permissions it needs to access the package shares will be added automatically by the package server component.
In versions previous to 7.6 HF7 there was a known issues that sometimes it was required the ACC to be put in a role with read rights to the AEX_AC _Identification Dataclass. This issue is documented in TECH232389.
If you are not using a domain account, it is recomended that you use the '
Settings > Notification Server > Site Server Settings > Package Server Settings
See also: HOWTO1552 "Altiris Notification Server and Altiris Agent user Security requirements"