Well, what you said is correct only when the vCenter server instance is added in so called 'shared session' mode.
The 'Add a vCenter Server instance' workflow provides an option to select also another mode - 'session per user' - in which case the credentials supplied in the workflow will be used only for registration purposes, but when later you perform another operation that calls vCenter API, the call will be made using the account of the current user. For example, if you login to vRO Java client with user@domain.com account and run some vCenter-related workflow like 'Rename VM', the operation on the vCenter will be invoked using user@domain.com account and not the account you supplied earlier in the workflow 'Add a vCenter Server instance'.