Custom Action runs in User Context or System Context?

Hi All,

I have one custom action which internally updates Order Entity. Now, the problem is when user clicks on button and custom action is triggered, user gets error message saying AccessRight is missing. Now, the order entity belongs to different user and different BU. So my user needs Global read on Order so that he can successfully trigger custom action.

But giving global right is not possible as client doesn't want to do that. 

What is the solution? Custom action runs in user context even if the custom action owner is admin?