>However iirc processes can opt out of this so only administrators can.

Can override those opts without admin as well.