I have a WebQuerySave agent that runs against documents that contain a Readers field. The WQS agent is signed by myself, and I have Manager access to the database (but I do not have Full Access Administrator).
The agent is not set to "Run as web user" and is not set to "Run on behalf of". Therefore, the agent should be running with my rights.
I have a document in the database which was created by a test user. The test user is in the Readers field, but I am NOT in the Readers field on the record (either directly or indirectly via a group/role), and I can not see the record when logged in with my id from the client or the web.
When I login from the web using the test id, and then edit and save the document, the WebQuerySave agent runs correctly and has access to the document via session.DocumentContext.
Is this normal? Given the WQS agent is signed by me, and I don't have Reader access to the record, I expected that the WQS agent would not be able to "see" the document. I'm glad the agent is running, but I'd like to know if this is "normal" behavior.