We used to use one AD account for all SQL Server services and another for all SQL Agent services. The service login account were changed after the install was complete, so we granted them both local admin rights on the servers. However, we have an isolated network where we had to conform to Federal requirements, one of which was no AD accounts unless absolutely necessary. We just decided to apply those requirement to all of our servers.