It all boils down to one simple thing: do you have access to the source code of the application?
If you do (and presumably buy-in to make these changes; also, technically, reverse-engineering falls into this category, but... you didn't hear that from me), it's simply a matter of searching, testing, and documentation. Smooth sailing, right? :)
If you don't, there are two cases:
The application is currently under license and/or the vendor/owner doesn't want you meddling. Making this kind of change is a definite no-no. There are rare cases where database-level changes are okay, but this certainly isn't one of them.
The application is out of license or the vendor/owner doesn't care what you do with it. In this case, there is no choice but to determine which permissions are required based on database queries made by the application. Technically, this isn't guessing, but you'll only ever find the permissions that are needed based on what has already occurred, not what is needed in the future. This comes down to thorough tracing (either Profiler or Extended Events) and testing.