A “on demand” workflow runs under the security context of the user who ran that workflow using the “Run workflow” option.
In all other cases workflow would always run under the context of the user who owns that workflow.
Let’s take a simple example to understand this
Suppose this is our workflow, which is registered against lead entity and which runs while a lead record is created and can be run “on demand” as well. It updates one of the fields in the lead record.
The owner of the record is “Nishant Rana” i.e. me.
Now if i log into the CRM and create a new lead record. The workflow would get triggered and update the record.
Now if we check the properties we would find this
Now suppose another user logs into CRM and creates a new lead record. The workflow would get triggered and it will update the lead record.
Here it would show the workflow owner’s name for the modified by field.
And if the same user is running the workflow manually using “Run Workflow” option, the modified by would get updated with the uuser’s name and not the owner of the workflow.