Do BPM's execute with user permissions?

I posted this about an hour ago but it seems to have disappeared.

Anyways, I've created a BPM to modify the credit hold and credit limit values when a user clicks a button on the Customer page. I've used field security to not allow the user to directly modify the credit hold and limit values.

However, the problem now is the BPM isn't executing properly and changing the values as it appears the BPM is executing with the user privs and therefore not able to modify the field values.

Anyone know a way around this?
I ask because I have a BPM created to modify a credit limit value and the credit hold toggle based on the changing of another field.

The problem is I have disallowed user access to credit limit and credit hold and the BPM isn't changing the values. Any user with full access to the fields runs properly, so makes me believe the user permissions are being applied to the BPM logic.

Anyone know if there's a way around this?