We have a process whereby when a workflow is certified, a data management job kicks off and copies specific Actual accounts into the Flash scenario.

this must be because the DM job is running a custom calculate business rule. In order to run a custom calculate, the user needs access to the destination scenario's manage data group setting. The manage data group security role also is meant to control who can run a reset scenario DM job. I would personally be comfortable with setting the Manage Data Group setting to everyone (or a security group of users that run custom calcs) as long as these users don't have access to the data management application page. ultimately with the Manage Data Group setting, you want to be careful and ensure that a user cannot execute an existing reset scenario DM job via the DM job page or create and run their own reset scenario DM job. The goal is to allow users to run custom calcs, but also ensure a user cannot go rouge and run a reset scenario job. These are the two process affected by the Manage Data security group.