When workflows are executed in Aria Orchestrator as part of an extensibility event from Aria Automation, they appear as started by vro-gateway in the "All runs" section.
VMware Aria Automation 8.x
This is expected behavior. The vro-gateway component is responsible for securely bridging Aria Automation and Aria Orchestrator. It acts as the service account that initiates workflows triggered from extensibility events.
Workflows started via extensibility will always show "vro-gateway" as the initiator in the Aria orchestrator's "All runs" view.
This behavior ensures proper separation of system-initiated workflows from those manually triggered by users. It also allows for consistent auditing of extensibility-driven automation.