Business Rules ignore security permissions for fields, for all roles. This is similar to developing user custom extensions to ExtraView using Java.
It is assumed that the developer of business rules understands that they have the ability to update the value of any field, without restriction, by using a business rule. Thus, a business rule may make an assignment to a field that is read-only to the user interface, or is not even placed on an add or edit screen layout.
