RunAs can propagate into a security context from an external context. And also a particular RunAs may be configured to be propagated out of the security context in question.