Doveadm-sync SSH practicalities

Hi,

The documentation is somewhat silent on this subject.

What permissions does the SSH user need ? How associated does it need to be with things like dovecot directory ownership etc ?

Obviously my dovecot daemon processes are running as restricted users with "nologin" shells etc., and I don't really want to go opening them up if I don't have to.

So could someone kindly please expand a little on how exactly doveadm-sync is supposed to work with SSH ?

Thanks

Terry