Question: what is the difference between plugin and workflow with regard to security restrictions?
Answer: Plugins are always triggered by the messages to which they're subscribed, though some Messages allow limiting execution based on whether certain attributes have been passed into the Message. Workflows can be turned off (by unpublishing). Plugins are always on. Custom workflow activities can be used in many Workflows.