Users that have restricted read/write access to Zabbix can create actions that will run for servers that they do not have access to.

In my test I created a action that looked for a trigger with a name like "Disk" and had it run a "Remote Command" operation that simply put text in a file on the Zabbix server. My user had no access to a particular server, but when the trigger went off for it, the action fired and the text was put into the file.