It would seem that the self-check user must have superlibrarian privileges, rather than the more safe-seeming circulation privileges. This is a bit of a security issue, since the cookies used on the self-checkout machine could then be modified for use with the staff client.
This doesn't appear to be the case: opac/sco/help.pl: flagsrequired => {circulate => "circulate_remaining_permissions"}, opac/sco/sco-main.pl: flagsrequired => { circulate => "circulate_remaining_permissions" }, opac/sco/sco-patron-image.pl:my ($query, $response) = C4::Service->init(circulate => 'circulate_remaining_permissions'); I've also tested this directly -- a normal staff user with just the circulation permission works fine.