So you have one Windows Account, One Credential,and One Proxy.

This account then has read/write on any external file locations as needed by any SSIS package.

Is this Windows account then used as the Login/User as the job owner? If so, do you make the User a DBO on the database or do you wrap all SSIS db calls into SPROCs and only give EXECUTE on each SPROC do this user?