IIS Permissions for new appPool ID

I am doing some testing and want to find out best practice for creating a new user to assign to an appPool.  I know that the default ASPNET account, on IIS 6.0, is very low permissions.  For experienced folks, what are the bare permissions required to grant this new user?  Yes, I am aware that various NTFS rights are required for different operations, such as reading outside of the application path, writing to the NTFS share, etc.  I am just looking at a base install. 
Dino Esposito wrote in Chapter 15 of Programming Microsoft ASP.NET 2.0 - Core Reference that the following directories would need the respective permissions:
.NET framework root - read/list Temporary ASP.NET folders - full GAC - read Windows System32 - access/read App root - access/read Web site root - scan What else would I need to set up beyond this base conf ...