I thought that the backup would run under the context of the service account for SQL Server. You submit the request under your SQL login, but the service account for SQL is what writes the file and needs rights.

You can change the rights for the service account in AD. I would only add rights to this account, not remove any.

If you run a copy, the Agent account will need the rights if it executes the copy.