In case anyone else is bitten by this, the documentation for rt-crontool states that the user under which rt-crontool will run needs to be given ModifyTicket and ShowTicket rights within RT
However if you are trying to use rt-crontool to modify ticket statuses and have a lifecycle other than default with different sset of statuses, rt-crontool needs to be able to read the queue as well in order to discover what the queue lifecycle is to which that ticket belongs.
Hence you need SeeQueue rights as well
Hope this helps someone not to have to waste a similar afternoon I won’t get back again…