I have an InfoPath form that starts a workflow (on item created). The business requirement is that after submission form must be read-only (no changes to the initial request can be made). However workflow must change certain properties of the form (e.g. approval time, approval phase etc.).
By default SharePoint workflows run under initiator account, however I am wondering would you recommend creating an event handler that is going to kick start a workflow under system account. Workflow would than be able to revoke all the contribute privileges but still be able to update the form during workflow.
EDIT: This is a declarative workflow.