Under what permission does Workflow run?

Question

I would like to know under which account does the workflow run when:-

1. Start manually

2. Automatically on item added/changed

3. And under account does an impersonation step run?

Answer 1

For 1. and 2. - the permissions of the current user will be used. So, if the workflow creates a list item in a site/list for which the current user does not have contribute permissions, the workflow will fail.

For 3. - If you use impersonation steps, the permissions of the person who last published the workflow will be used.

Caveat: if that person now has different permissions (changed departments, is no longer administrator) or if that person has left the company and their account has been ceased or deleted, the workflow will fail.

As far as I'm concerned, impersonation steps should never be created by a real user, but rather by a service account or dedicated workflow account with the required permissions. Use that account to create the workflow and the impersonation step. This way, no matter who YOU are when you create the workflow, the impersonation account will always be a valid account for the company, even if you change positions, permissions or jobs.

Answer 2

Impersonation Step is easiest: The last person that published the workflow.

In any other case it's the current user I believe.

Source: Impersonation Step