I would suspect code order, the update is probably before the security assist code.
it would be better to use a standard form trigger, and just restrict access to the page for only supper admins.
using supper admin as the trigger, it will try to perform the update on page access, not just when the update button is pressed.