I recently received an email from a new ProcessFlow user asking how to get an AGS call to work to update PA42 with the correct status for a job requisition approval flow. She sent me her current AGS call and I compared it to one I knew worked. The only thing missing was the &FROM-WORKFLOW=Y section.
I get questions like this from time to time about why an AGS call from ProcessFlow (or Design Studio) doesn't work and the first question I usually ask is can you perform the update on the actual form in Portal? If they can then it's not a security issue (it often is even for the "Lawson" user).
Now comes the debugging part - what is happening on the Portal form that isn't included in the AGS call? I usually start with the API Builder tool to test my AGS call. You'd be surprised how often the results let you know that a field is required that you left out.
Sometimes though it's not obvious and you just have to keep adding fields until you get to a complete AGS call (and sometimes the additional fields don't make sense to you).
However another option is to use a tool like Fiddler to debug the working AGS call from your Portal form. Once you see what Lawson sends itself in the way of an AGS call you can usually duplicate it to get your ProcessFlow or Design Studio AGS call working correctly.