What we generally do is have a specific account for running server-side scripts. That account has precisely tuned credentials that allow it to do just what it needs to do to run the schedules, and nothing more. If you have a multi-file solution like this, you can automate changing the password to make it easier to manage.
Edit: And yes, it's a pain in the rear.
Thanks, Mike - great suggestion. Believe it or not, it had not occurred to me to write a script to change the special account password in every file! Yes, pain in the rear to setup, but once done the maintenance with a script won't be so bad.
I hadn't really even given any thought to this. Thanks for posting. I'll store this tidbit of knowledge in my todo book!