Workflows can be run as admin, user or a workflow user called by a user.
All can be set in central admin to restric the access of workflows. If you want you can also have runwithelevatedpriv:
If an impersonation step is encountered, the declarative workflow is
run in the context of the workflow associator. The default workflow
tasks respect SharePoint permissions by impersonating the user who
started a workflow when the workflow is run
also this outlines the Required permissions to start a workflow:
Required permissions to start a workflow
In addition to preventing the elevation of permissions in the code,
list administrators can restrict the permission level that is required
to start a workflow during the association process. Administrators can
select either of two permission levels to start a specific workflow
association: Edit Item or Manage List.
The default setting for associating a workflow is to allow users with
Edit Item permissions to manually start a workflow. This means that
any authenticated SharePoint Server 2010 user on the list who has Edit
Item permissions can start an instance of this workflow association.
If during workflow creation the administrator selects the option to
require that the user have Manage Lists permissions in order to start
the workflow, only list administrators can start an instance of this
association.
Because workflows are designed to be used by standard contributors,
most workflows do not require the restriction to Manage Lists
permissions. However, administrators can use this setting for
workflows such as a document disposal workflow, where the
administrator wants only certain people to execute the disposal
actions.
http://technet.microsoft.com/en-us/library/ee428324.aspx
