In my neck of the woods, "casuser" has no cron access, i.e. it's neither in cron.allow nor cron.deny. That's supposedly why I cannot schedule LMS backups via the GUI. It's the same situation with "at". Then I came across this documentation:
"Software Management uses at and cron to schedule Software Management image transfers to devices. The process that performs the download is executed as casuser, so the user casuser must be allowed to use at and cron."
Well, SWIM has worked fine so far. How does it manage to get around the lack of at and cron access?