Permission for Runing Scripts on Session Hosts or Servers

In reviewing permissions necessary for running scripts on Servers or Session Hosts, I'd like to see a permission less than .Update for running Windows Scripts. Scripts are a way to control what is being done in an environment, and as such they can be more restricted (and tested) than having an open door to modify anything on a session host or VM. Therefore, it seems the product could use a lesser privilege.