Installing EBS in a restrictive environment

We have a customer in the financial services industry that has a strict set of policies in place regarding creating Oracle databases and they want us to follow their policies when we install EBS for them. For example, when installing a database, they will use DBCA standard template to create the database, then they give you a non-SYS% user ID to populate the database. Also, application user privileges are allowed to include SELECT, INSERT, UPDATE and DELETE. If you really need it, they will give you EXECUTE.
This doesn't quite work for an EBS database, either during installation or normal usage. They clearly will not like the list of privileges granted to APPS or other EBS users. One of the things they are asking for is a comprehensive list of everything that violates their policy, but I have never tried to identify all of the privilege requirements for an EBS database.