Unhandled Object Exception Access is Denied Party!

So today I encountered a rather odd situation.  The client was able to access GP, but when clicking on a home page or area page she would receive "Unhandled Object Exception" and "Access Denied" errors.   Other than "Access Denied", the "Unhandled Object Exceptions" would also say "Error Calling Method Save".  So it seemed to be a permission issue obviously :)

I found some references to errors with the home page being tracked back to the appropriate files not being found in the Backgrounds folder:
AreaPage.xsl

HomePage.css
HomePage.xsl
PreviewPane.xsl
So we checked it out, and the files were all in the appropriate location.  Dead end. 

But we did find that the user could not create a file in the C:\Program Files\Microsoft Dynamics\GP\Backgrounds folder.  But changing the permissions on that folder did not correct it.  So we check the plain ol' C:\Program Files\Microsoft Dynamics\GP folder.  Oddly, it had been set to Read Only as well.  So we changed both, and viola! the user can log in and access home pages and area pages successfully.

But this begs the question(s)....
1.  What are the true minimum permissions for the Microsoft Dynamics GP user directory?  A poll of coworkers said "Full Control" and I know that is what I have always done.  But is that true?  Could we get by with less (and appease many IT folks who would cringe at the "Full Control" notion)?
2.  Also, what would have changed the permissions for all users?  A gremlin?  A gnome?  Something had to change it, right?

So this post ends with more questions than answers, but I found it all interesting regardless so I thought I would share!