RE: What gives general users the privilege to 'accept new code' on a new install?
Updates shouldn't be putting any .cnk files into the GP directory, thus, normally users won't be prompted to add new code to the Dynamics.set file or anything like that.
If you are seeing this, try uninstalling and re-installing the Dexterity Shared Components for that install of Dynamics GP, as that is what usually processes the .cnk files outright, so users aren't prompted to add new code, like they were back in the Dynamics GP 9.0 or prior versions.
That being said, third party products and customizations such as those made through Dexterity, or even manually adding some GP features such as PSTL may cause you to have to put .cnk files into the GP directory and users would be prompted to add new code when they next launch the application from that directory.
There really isn't a set permissions specific for this process, though launching Dynamics GP using 'Run As Administrator', as that may allow them to add new code when needed, otherwise, if not Full Control to the Dynamics GP directory, try giving the users a minimum of Read/Write and go from there.
Read/Write permissions are also recommended for any shared network directories holding forms and/or reports dictionary files as well as the user's own TEMP directory, which Dynamics GP also writes files to.
If your environment is 'locked down' so to speak, there may also be group policies that may need to be modified to allow users to do this process as well, as each customer's environment would be a bit different.
Let us know if you have further questions,
Thanks