I created a Windows account with no extra rights other than domain user and set it as the SQL Server Agent service account with the SQL Server Configuration Manager.
The BoL/MSDN says that this user should be part of the sysadmin role to work but at this point I haven't taken any action to make this happen.
I expected that the account could do nothing but it appears it's ... a sysadmin! If you put the following statement in a job step it will confirm this:
IF IS_SRVROLEMEMBER ('sysadmin') = 1 print 'sysadmin'
The job step is a t-sql step with sa as owner so the SQL Server Agent service account is used.
Now for the question. It seems SQL Server Configuration Manager does something that makes this a sysadmin or at least when it is executing the step. BUT at the same time it does not show up in the list of the sysadmins in the GUI.
All the reports or queries I come up with (including SSMS) do not list this Windows account as part of the sysadmin role.
I have the feeling I am overlooking something.