At:

• Constraints:
  Whenever the process engine invokes user code:
  1. the currently authenticated user is set on the thread (ie: if identityService.setAuthentication() was invoked from the same thread earlier, the authentication is still present
  2. If the user code executes nested commands, authorizations are not enforced.

• the second constraint is configurable (can be switched on / off in configuration)