According to discussion on ELY-835, it seems that automatic outflow from security domains won't work. Batch subsystem should perform security identity inflow in case that its security domain is different from the domain which was used to authenticate the current user, for example when a user is executing a job using management APIs.